[Pki-users] CMCEnroll: java.io.IOException: Internal Error - java.io.IOException: Sequence tag error 9

Jan Meijer Jan.Meijer at uninett.no
Fri Oct 31 17:40:24 UTC 2008


Hi Mike,

On Fri, 31 Oct 2008, Michael Peck wrote:

> Try removing all of the text from your request file before the -----BEGIN
> NEW CERTIFICATE REQUEST----- line.  (The "Certificate request generated by
> Netscape certutil...Phone...", etc text.)
> I tried that and then CMCEnroll worked on your request on my system.
>
> I'm not sure if your request is really malformed, it just doesn't have any
> Attributes in it, so the SET OF Attributes (PKCS#10) is zero length and
> dumpasn1 complains.

And indeed it does over here as well, working that is.  My request is not
malformed out of the ordinary.  The zero length that dumpasn1 complains
about is explained by Steve Henson:

http://www.mail-archive.com/openssl-dev@openssl.org/msg10922.html

I tested further today and got more frustrated and then got it working
and now I think I know what's going on.  Thanks for delivering the final
piece to my little puzzle :)

I tested with requests generated by certutil and openssl.  And given my
familiarity with openssl I started with that.  CMCEnroll bombed on the
openssl PEM input, so I figured, well, convert it to DER.  And then the
bombing was different and I got the error I sent to the list.

Because this approach didn't work, switched to certutil *testing with the
binary output*.  I did test it with ASCII output but apparently didn't
test with the stuff in front of the actual request removed, otherwise I'd
have found the right way yesterday already.

I got it working today with a request generated by the pkiconsole.  An
ascii request.  And then I tried your suggestion and yes, it worked as
well.

Then I tried again with my openssl ascii output, and no, didn't work.
But, then I converted the openssl DER output to binary using the AtoB
utility and *then* it worked.

I don't know enough intricate details about the formats the requests can
be in but am tempted to say that the openssl binary format is incompatible
with what is expected by CMCEnroll.

And little technologist, what did you learn today?  That when confronted
with multiple options I should document what I've tested in a proper test
matrix.

And, oh lucky me, I learned to use certutil.  I think that tool is a bit
clunky ;)


Mike, Marc, thanks for your help :=)  I'm now unstuck and on the road to
bliss.

-- 
Jan





More information about the Pki-users mailing list