[Pki-users] SHA-256 signed CMC revocation messages failing to verify on server

[Nimeh, Jamil]

Hello Dogtag Gurus,



I have been trying to issue CMC revocation messages signed with SHA-256, but the server fails to validate the message in the CMCAuth java policy module.  If I leave all fields the same but change the signature algorithm to SHA-1 then everything seems to work fine.



I suspect this is another side-effect of the root-cause for bug 824624.  It seems like in certain cases with JSS 4.2.6 when PKCS#7 messages are created using any of the SHA-2 variants, the OIDs get messed up.  This happened with SCEP responses from the CA (the bug referenced above) and I had it happen with the CMC revoke modifications I made.  The latter issue was fixed by pulling down JSS 4.3 and loading that jar in the classpath for the modified CMCRevoke tool.  However, on the server side I ended up seeing verification failures.



I'm running pki-common-9.0.20, jss 4.2.6, and NSS 3.13.4.  At one point I had heard that Dogtag 9.0.X wasn't 100% safe to run with JSS 4.3 or later.  Is that still the case with the latest 9.0 packages?


Has anyone had any success generating these CMC messages using SHA-2 hash algs and getting Dogtag to accept them?


Thanks,

Jamil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pki-users/attachments/20120919/905b9fca/attachment.htm>