KCA gives invalid signature when approving certificate request
Originally Published: 2003-06-05
Article Number
Applies To
Microsoft Windows 2000 Server SP3
Certificate enrollment with a PKCS#10
Issue
Request does not give error on older versions of KCA
Cause
Attributes { ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}
The "Attributes" field is not marked as OPTIONAL, so it must be present. However, a "SET OF" can include zero or more elements. So, a properly constructed Certificate Request with no attributes will include the encoded SET OF with a zero length for the contents.
Historically, some PKI products (including earlier versions of the Keon Certificate Authority) have misinterpreted the standard and omitted the "Attributes" field when no attributes were present. This causes interoperability issues, and the issues have been fixed in later versions of KCA.
When attempting to import into KCA a PKCS#10 Certificate Request that omits the "Attributes" field, an error will be returned.
Resolution
Workaround
KCA 6.5 validates certificate request where older versions did not
Related Articles
RSA Governance & Lifecycle IBM Tivoli Directory Server (ITDS) Connector Datasheet Guide Number of Views Access to Restricted Agents by Active Directory Groups Number of Views Best practices for RSA Identity Governance & Lifecycle deployments Number of Views RSA Identity Governance and Lifecycle - Novell eDirectory Connector Datasheet Number of Views RSA Governance & Lifecycle Recipes: Chart - Application - Application Shared Accounts Number of Views
Trending Articles
RSA Authentication Manager 8.7 SP2 Setup and Configuration Guide RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide How to Upgrade Internal SHA-1 Certificates to SHA-256 in Authentication Manager Using rsautil RSA Release Notes for RSA Authentication Manager 8.8 RSA Authentication Manager 8.9 Setup and Configuration Guide
Don't see what you're looking for?
