9.4. CMC SharedSecret Authentication
Use the Shared Secret feature to enable users to send unsigned CMC requests to the server. For example, this is necessary if a user wants to obtain the first signing certificate. This signing certificate can later be used to sign other certificates of this user.
9.4.1. Creating a Shared Secret Token
The The Shared Secret Workflow section in the Red Hat Certificate System Planning, Installation, and Deployment Guide describes the workflow when using a Shared Secret Token. Depending on the situation, either an end entity user or an administrator creates the Shared Secret Token.
Note
To use the shared secret token, Certificate System must use an RSA issuance protection certificate. For details, see Enabling the CMC Shared Secret Feature section located in RHCS Planning, Installation, and Deployment Guide.
To create a Shared Secret Token, enter:
# CMCSharedToken -d /home/user_name/.dogtag/ -p NSS_password \ -s "CMC_enrollment_password" -o /home/user_name/CMC_shared_token.b64 \ -n "issuance_protection_certificate_nickname"
If you use an HSM, additionally pass the
-h token_name option to the command to set the HSM security token name.
For further details about the
CMCSharedToken utility, see the CMCSharedToken(8) man page.
Note
The generated token is encrypted and only the user who generated knows the password. If a CA administrator generates the token for a user, the administrator must provide the password to the user using a secure way.
After creating the Shared Token, an administrator must add the token to a user or certificate record. For details, see Section 9.4.2, “Setting a CMC Shared Secret”.
9.4.2. Setting a CMC Shared Secret
Depending on the planned action, an administrator must store a Shared Secret Token after generating it in the LDAP entry of the user or certificate.
For details about the workflow and when to use a Shared Secret, see the The Shared Secret Workflow section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.
9.4.2.1. Adding a CMC Shared Secret to a User Entry for Certificate Enrollment
To use the Shared Secret Token for certificate enrollment, store it as an administrator in the LDAP entry of the user:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: uid=user_name,ou=People,dc=example,dc=com changetype: modify replace: shrTok shrTok: base64-encoded_token
9.4.2.2. Adding a CMC Shared Secret to a Certificate for Certificate Revocations
To use the Shared Secret Token for certificate revocations, store it as an administrator in the LDAP entry of the certificate to be revoked:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=certificate_id,ou=certificateRepository,ou=ca,o=pki-tomcat-CA changetype: modify replace: shrTok shrTok: base64-encoded_token
