Simple automatic certificate enroller
An idea of Paolo Prandini.
Copyright (c) Alberto Forino 2004.
All rights reserved. See the file COPYRIGHT for licensing information
 |
HOW TO COMPILE ?
The program should be compiled on Unix system with OpenSSL libraries .
In order to compile you have to run the make command in the sources directory
$ make
After that make clean command will remove object files
$ make clean
Obtain the program version by using the -version option
$ autosscep -version
HOW TO USE AUTOSSCEP?
To use Autoscep you need the configuration file. Write it by using the HOWTOCONFIGURE manual. After that you can run AutoSscep by passing the configuration file as argument.
$ autosscep myconf.conf
HOW DOES IT WORK ?
If you specify in the config file one (or more) existent certificate(s) Autoscep checks the expiration date and enrolls if it's required.
If you specify a non existent certificate Autoscep requests it at the specified CA creating a certification request PKCS#10 based on the data specified in the config file.
If the CA returns the certificate enrolled AutoSscep writes it in the specified directory and renames the old certificate in [certname].old otherwise, if the CA returns a pending message , AutoScep saves the transaction ID in the certs directory in [certname].pending.
It will be used to resume the transaction.
(To run AutoSscep succefully you need the read/write permission on the certificates, CAs and the keys directories.)
Before starting a new scep transaction AutoSscep checks [certname].pending file . If the file exists AutoSscep starts the transaction with the identifier saved into the file.
If the CA returns an error status code, AutoSscep displays the error code and the error description (by internet drafts) and then AutoSscep exits or tries another certificate transaction.
At the end AutoSscep summarizes the situation displaying certificates state or errors occurred.
WRITING CONFIGURATION FILE
Writing the configuration file is not too difficult
Read the complete manual :
English
ERRORS
In the summary should be signaled these errors
ERR_CA_BAD_ENC_ALGO -1
In the config file is specified an unknown encryption algorithm. The known ones for Autosscep are des, blowfish e 3des.
ERR_CA_CERT_MISSING -2
Impossible to find Certification Authority certificate (This error should not verify anymore: from version 0.9.12 Autosscep requests missing CA certificate to the CA)
ERR_CA_ENC_CERT_MISSING -3
Impossible to find ca encryption cert
ERR_CA_BAD_CONFIG -4
An error occurred while reading the config file in the CA session, please check the config file and the HOWTOCONFIGURE manual
ERR_CERT_MISSING_CERT -6
The cert file is missing. (This error can occur only in very particular situations)
ERR_CERT_BAD_CONFIG -7
An error occurred while reading the config file in the cert session, please check the config file and the HOWTOCONFIGURE manual
ERR_CERT_MISSING_CA -8
No CA found for this certificate (check DN in config file).
ERR_CERT_KEY_MISSING -9
The key file is missing. This error occurs only with pending requests if the file [key_file].new is missing in the keys directory.
ERR_CERT_REQ_MISSING -10
The cert req file [nomecert].csr is missing. This error occurs only with pending requests if the file [nomecert].csr is missing in the certificate directory.
ERR_CERT_BAD_REQ -11
Bad request : error occurred while reading the cert request, the file could be in a wrong format or corrupted
ERR_CERT_CREATING_SELFSIGNED -12
Unable to create self signed certificate, check your OpenSSL libraries
ERR_CERT_PKCS7_WRAP -13
Unable to create pkcs7 message, check your OpenSSL libraries
ERR_CERT_HTTP -14
Error occurred while sending http message. Check the connection, the scep URL, the listening port for scep service of your CA
ERR_CERT_PKCS7_UNWRAP -15
Unable to open pkcs7 message, the message could be corrupted or in a bad format
ERR_CERT_BAD_REPLY -16
Bad reply from server
ERR_IO -17
General I/O error
ERR_CA_FAILED_CACERT_REQ -18
Failure while requesting CA certificate from CA scep service. The CA certificate is not available yet
Via Liguria, 5 • 25125 BRESCIA • Italy
tel. +39 0302427266 • fax +39 02700406565 • email info@spe.it