The Problem is creating a CERT, then deleting the CERT, then creating the CERT again.
Astaro Workaround: Change 1 character
ok, so i just setup 30 CERTs and noticed a mistake in one. I then started to ask, in which field can I change one character? Unfortunately I didnt like the result that I came up with.
Static = must be the same
Dynamic = can be different
The fields that I see as Static are because this information is passed in the Public Key:
Country, State/Region, City/Locality, Organization, Dept./Org.Unit, Common Name, and Email Address
so whats left where i can change something?
Dynamic Fields:
VPN ID, Name, Passphrase, Key Size (err not sure if it should be changed or not. performace problem if increased in size?)
so after changing the name, pass, and key I still couldnt issue a CERT.
I then went into the /etc/wfe/ipsec.d directory and started to playing with fire.
no *.pems reguarding the deleted CERT in any of the directorys listed, except in /etc/wfe/ipsec.d/ssl/private. there are .pem files with names like 01, 02 and so one. after examining every file i found 2 that had a reference to the same name that i was trying to setup.
here comes the fire. I am assuming that the filenames are also bound to the index.txt file (which im not sure what the fields mean. anyone know?). I copied the 2 pems to a backup directory and deleted them from the private.
Are all of my CERTS now unusable? havent tested it yet. There are a LOT more PEM files then are listed in the index.txt. whats the connection between the two?
Tried to setup a new key, no luck. I then Hacked around in the /var/chroot-ipsec/etc/ipsec.d directory, but didnt find anything that referenced the old deleted keys.
now i am kind of stuck. Does anyone know exactly where/what is saved and where/what should be removed?
The only solution that I see at this time is to delete the CA, and all CERTS. then delete all *.pem files in the /etc/wfe/ipsec.d directory and removing all entries from the index.txt file. Then [:O]rst place.
bit risky though. I'm not ready to create 30 new CERTS as it is a bit time consuming with all of the Export as PKCS#12, extracting the Public Key, uploading the Public Keys to the Key Server and so on... to add to the complication, setting up SSH and all the Hardware Tokens (fortunately I havent done it yet).
However if in the future there should be 1 little error, it needs to be correctable, without having to setup the whole lot of CERTS again. [:S]
[size="1"][ 19 July 2002, 06:55: Message edited by: Tmor ][/size]
This thread was automatically locked due to age.
