Re: Cryptlib CMP CA must always be the same for one user?
Peter Gutmann <[email protected]>
| Newsgroups | gmane.comp.encryption.cryptlib |
|---|---|
| Message-ID | <[email protected]> |
zhou y <[email protected]> writes: >I have a problem when setup the Cryptlib CMP CA and use CMP for automation. I >have to deploy two CAs, one is for a product production phase and use ir to >store the first cert in the product, then when the product is deployed in >real world, I have to use another CA for a further cr process in order to >build trust with other services. However, I find the 2nd cryptlib CA cannot >auth the product at all, even you create a PKI user in that CA using the same >DN. That's because the cr (for CA #2) is auth'd using a cert issued by CA #1. Since you're using two different CAs, CA #2 has no way of knowing that the cert from CA #1 is valid for authenticating/authorising the transaction. >It seems the cryptlib checks the certId and trying to trace back all the way >on that client till the first ir use its own database. If I am not wrong, is >there any other way or I have to turn to other CMP CA? It's not the first ir, it's just an authorised certificate. Since CA #2 has no idea what CA #1 has authorised (because it's a different CA), it can't tell that the certificate is valid (the extended error info should say something to this effect when you try to do the cr). If you want to use certificates from CA #1 to authorise the issue of further certs from CA #2 then you need to figure out some way to handle this. Possibly using the same cert store for both CAs would do it, since CA #1's issued certs will be present where CA #2 can see them. (Switching to a different CMP CA won't fix this, because they won't know about the second CA's certs either. The problem is that you're trying to use certs from one CA to authorise operations at a completely different CA). Peter. _______________________________________________ Cryptlib mailing list [email protected] via Mail: [email protected] Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/ http://news.gmane.org/gmane.comp.encryption.cryptlib Posts from non-subscribed addresses are blocked to prevent spam, please subscribe in order to post messages.