Re: Plug-n-Play PKI

Hey Peter,
When you have a moment, I could sure use some help with this.

Thanks!
Ed

On Dec 6, 2010, at 2:19 PM, Edward Curren wrote:

> Hey Peter,
> 
> I'm trying to setup Plug-n-Play PKI using CMP. I am getting a return code of CRYPT_ERROR_OPEN (-40) at the point where the code sets the connection to active.  Below is the code that I use to create the CA keys and database, start the CA CMP server and the CMP client information.
> 
> Any help you can provide in pointing me to the problem will be appreciated.
> 
> Thanks Peter.
> Ed
> 
> 
> // ************************  Setup Methods *************************//
> 
> Setup::CreateCertificateAuthorityKeyPair
> 	(String caKeystoreName, String privateKeyLabel, String password,
> 	String countryCode, String organizationName, String commonName,
> 	String organizationalUnitName, String certStoreUrl, String rtcsUrl)
> {
>    int result = 0;
> 
>    CRYPT_CONTEXT cryptContext;
>    CRYPT_CERTIFICATE cryptCertificate;
>    CRYPT_KEYSET cryptKeyset;
> 
>    /* Create an RSA public/private key context, set a label for it, and generate a key into it */
>    result = cryptCreateContext( &cryptContext, CRYPT_UNUSED, CRYPT_ALGO_RSA );
>    result = cryptSetAttributeString( cryptContext, CRYPT_CTXINFO_LABEL, privateKeyLabel().c_str(), privateKeyLabel.length() );
>    result = cryptGenerateKey( cryptContext );
> 
>    /* Create the CA certificate and add the public key */
>    result = cryptCreateCert( &cryptCertificate, CRYPT_UNUSED, CRYPT_CERTTYPE_CERTIFICATE );
>    result = cryptSetAttribute( cryptCertificate, CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, cryptContext );
> 
>    /* Add identification information */
>    result = cryptSetAttributeString( cryptCertificate, CRYPT_CERTINFO_COUNTRYNAME, countryCode().c_str(), 2 );
>    result = cryptSetAttributeString( cryptCertificate, CRYPT_CERTINFO_ORGANIZATIONNAME, organizationName().c_str(), organizationName.length() );
>    result = cryptSetAttributeString( cryptCertificate, CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, organizationalUnitName().c_str(), organizationalUnitName.length() );
>    result = cryptSetAttributeString( cryptCertificate, CRYPT_CERTINFO_COMMONNAME, commonName().c_str(), commonName.length() );
>    result = cryptSetAttribute( cryptCertificate, CRYPT_CERTINFO_SELFSIGNED, 1 );
>    result = cryptSetAttribute( cryptCertificate, CRYPT_CERTINFO_CA, 1 );
> 
>    result = cryptSignCert( cryptCertificate, cryptContext );
> 
>    /* Save the generated public/private key pair to a keyset */
>    result = cryptKeysetOpen( &cryptKeyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, caKeystoreName().c_str(), CRYPT_KEYOPT_CREATE );
>    result = cryptAddPrivateKey( cryptKeyset, cryptContext, password().c_str() );
>    result = cryptAddPublicKey( cryptKeyset, cryptCertificate );
>    result = cryptKeysetClose( cryptKeyset );
> 
>    /* Clean up */
>    result = cryptDestroyContext( cryptContext );
>    result = cryptDestroyCert( cryptCertificate );
> }
> 
> void Setup::CreateCertificateAuthorityDatabase(String databaseName)
> {
>    int result = 0;
>    CRYPT_KEYSET cryptKeyset;
>    result = cryptKeysetOpen(&cryptKeyset, CRYPT_UNUSED, CRYPT_KEYSET_DATABASE_STORE, databaseName().c_str(), CRYPT_KEYOPT_CREATE);
>    result = cryptKeysetClose(cryptKeyset);
> }
> 
> 
> //  **********************   Test class methods  ********************* //
> TestCryptography::TestCryptography()
> {
> }
> 
> void TestCryptography::initTestCase()
> {
> }
> 
> void TestCryptography::cleanupTestCase()
> {
> }
> 
> void TestCryptography::startCmpServer()
> {
> 	String databaseName = "C:\\\\cadb.db3";
>        String keystoreName = "C:\\\\caKeyStore.p15";
> 	String privateKeyLabel = "CertificateAuthorityKey";
> 	String password = "P@ssw0rd";
> 
> 	Cryptography::Instance()->StartCmpServer(keystoreName, databaseName, privateKeyLabel, password);
> }
> 
> void TestCryptography::runCmpClient()
> {
> 	CRYPT_SESSION cryptSession;
> 	CRYPT_KEYSET cryptKeyset;
> 
> 	Cryptography::Instance()->GenerateKeyPair("C:\\\\ClientKePair.p15", "ClientKeyPair", "p@ssw0rd1");
> 
> 	/* Create the CMP session and private-key keyset */
> 	cryptCreateSession( &cryptSession, CRYPT_UNUSED, CRYPT_SESSION_CMP );
> 	cryptKeysetOpen( &cryptKeyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "C:\\\\ClientKePair.p15", CRYPT_KEYOPT_NONE );
> 	/* Add the server name/address */
> 	cryptSetAttributeString( cryptSession, CRYPT_SESSINFO_SERVER_NAME, "192.168.109.130", 15 );
> 	/* Add the username, password, and private-key keyset */
> 	cryptSetAttributeString( cryptSession, CRYPT_SESSINFO_USERNAME,	user.GetCaUserId().c_str(), user.GetCaUserId().length() );
> 	cryptSetAttributeString( cryptSession, CRYPT_SESSINFO_PASSWORD,	user.GetCaIssuePassword().c_str(), user.GetCaIssuePassword().length() );
> 	cryptSetAttribute( cryptSession, CRYPT_SESSINFO_CMP_PRIVKEYSET,	cryptKeyset );
> 	/* Activate the session */
> 	cryptSetAttribute( cryptSession, CRYPT_SESSINFO_ACTIVE, TRUE );
> }
> 
> 
> 
> // *********************  Cryptography class methods  ***************************//
> 
> void Cryptography::CreateNewPKIUser(String caKeystoreName, User &user)
> {
> 	CRYPT_KEYSET cryptCertStore;
> 	CRYPT_CERTIFICATE cryptPKIUser;
> 
> 	char userIdBuffer[ CRYPT_MAX_TEXTSIZE + 1 ];
> 	char issuePasswordBuffer[ CRYPT_MAX_TEXTSIZE + 1 ];
> 	char revokePasswordBuffer[ CRYPT_MAX_TEXTSIZE + 1 ];
> 
> 	memset(userIdBuffer, '\0', CRYPT_MAX_TEXTSIZE + 1);
> 	memset(issuePasswordBuffer, '\0', CRYPT_MAX_TEXTSIZE + 1);
> 	memset(revokePasswordBuffer, '\0', CRYPT_MAX_TEXTSIZE + 1);
> 
> 	int userIdLength = 0;
> 	int issuePasswordLength = 0;
> 	int revokePasswordLength = 0;
> 
> 	String commonName = user.GetFirstName() + " " + user.GetLastName();
> 
> 	cryptKeysetOpen(&cryptCertStore, CRYPT_UNUSED, CRYPT_KEYSET_DATABASE_STORE, caKeystoreName.c_str(), CRYPT_KEYOPT_NONE);
> 
> 	/* Create the PKI user */
> 	cryptCreateCert( &cryptPKIUser, CRYPT_UNUSED, CRYPT_CERTTYPE_PKIUSER );
> 	
> 	/* Add identification information */
> 	cryptSetAttributeString( cryptPKIUser, CRYPT_CERTINFO_COUNTRYNAME, user.GetCountryCode().c_str(), 2 );
> 	cryptSetAttributeString( cryptPKIUser, CRYPT_CERTINFO_ORGANIZATIONNAME, user.GetOrganization().c_str(), user.GetOrganization().length() );
> 	cryptSetAttributeString( cryptPKIUser, CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, user.GetOrganizationalUnit().c_str(), user.GetOrganizationalUnit().length() );
> 	cryptSetAttributeString( cryptPKIUser, CRYPT_CERTINFO_COMMONNAME, commonName.c_str(), commonName.length() );
> 
> 
> 	/* Add the user information to the certificate store */
> 	cryptCAAddItem( cryptCertStore, cryptPKIUser );
> 	
> 	cryptGetAttributeString(cryptPKIUser, CRYPT_CERTINFO_PKIUSER_ID, userIdBuffer, &userIdLength);
> 	cryptGetAttributeString(cryptPKIUser, CRYPT_CERTINFO_PKIUSER_ISSUEPASSWORD, issuePasswordBuffer, &issuePasswordLength);
> 	cryptGetAttributeString(cryptPKIUser, CRYPT_CERTINFO_PKIUSER_REVPASSWORD, revokePasswordBuffer, &revokePasswordLength);
> 
> 	
> 	user.SetCaUserId(String::fromAscii(userIdBuffer));
> 	user.SetCaIssuePassword(String::fromAscii(issuePasswordBuffer));
> 	user.SetCaRevokePassword(String::fromAscii(revokePasswordBuffer));
> 
> 	/* Clean up */
> 	cryptDestroyCert( cryptPKIUser );
> }
> 
> void Cryptography::StartCmpServer(String caKeypairFilename, String caKeystoreName, String privateKeyName, String privateKeyPassword)
> {
> 	Concurrent::run(CmpServer, caKeypairFilename, caKeystoreName, privateKeyName, privateKeyPassword);
> }
> 
> void CmpServer(String caKeypairFilename, String caKeystoreName, String privateKeyName, String privateKeyPassword)
> {
> 	CRYPT_SESSION cryptSession;
> 	CRYPT_KEYSET cryptCertStore;
> 	CRYPT_KEYSET cryptCaKeyset;
> 	CRYPT_CONTEXT privateKey;
> 
> 	cryptKeysetOpen(&cryptCertStore, CRYPT_UNUSED, CRYPT_KEYSET_DATABASE_STORE, caKeystoreName.c_str(), CRYPT_KEYOPT_NONE);
> 	
> 	cryptKeysetOpen(&cryptCaKeyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE, caKeypairFilename.c_str(), CRYPT_KEYOPT_READONLY);
> 	cryptGetPrivateKey(cryptCaKeyset, &privateKey, CRYPT_KEYID_NAME, privateKeyName.c_str(), privateKeyPassword.c_str());
> 	/* Create the session */
> 	cryptCreateSession( &cryptSession, CRYPT_UNUSED, CRYPT_SESSION_CMP_SERVER );
> 
> 	/* Add the CA certificate store and CA server key and activate the session */
> 	cryptSetAttribute( cryptSession, CRYPT_SESSINFO_KEYSET,	cryptCertStore );
> 	cryptSetAttribute( cryptSession, CRYPT_SESSINFO_PRIVATEKEY, privateKey );
> 	cryptSetAttribute( cryptSession, CRYPT_SESSINFO_ACTIVE, 1 );
> }
> 
> 


_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.