0

I am setting up workers for PDF signing and time stamping. I use PKCS #12 certificate generated from EJBCA. key is SHA256WithECDSA encryption is ECDSA prime256v1. After using this properties(https://pastebin.com/bkpNBvc1) for setting up I am getting this results:

20:45:45,531 INFO  [org.signserver.server.log.IWorkerLogger] (default task-1) AllVariablesLogger; CLIENT_IP: 127.0.0.1; XFORWARDEDFOR: null; XCUSTOM1: null; LOG_TIME: 1605991545531; CLIENT_AUTHORIZED: true; EXCEPTION: org.signserver.common.CryptoTokenOfflineException: Signtoken isn't active.; WORKER_AUTHTYPE: NOAUTH; WORKER_NAME: PDFSigner; KEYALIAS: signer00003; PROCESS_SUCCESS: false; WORKER_ID: 4; CRYPTOTOKEN: CryptoTokenP12PdfSigner; REQUEST_LENGTH: 252361; REQUEST_FULLURL: http://localhost/signserver/process?null; FILENAME: document.pdf; LOG_ID: a2c32acb-f5af-4b8f-9104-0ad942c379a3; REPLY_TIME:1605991545531

When I use enrollment code as keystore password it provides this result.

22:34:59,578 INFO  [org.signserver.server.log.IWorkerLogger] (default task-14) AllVariablesLogger; CLIENT_IP: 127.0.0.1; XFORWARDEDFOR: null; XCUSTOM1: null; LOG_TIME: 1605998099578; CLIENT_AUTHORIZED: true; EXCEPTION: org.signserver.common.CryptoTokenOfflineException: No key available for purpose: signer00003; WORKER_AUTHTYPE: NOAUTH; WORKER_NAME: PDFSigner; KEYALIAS: signer00003; PROCESS_SUCCESS: false; WORKER_ID: 4; CRYPTOTOKEN: CryptoTokenP12PdfSigner; REQUEST_LENGTH: 252361; REQUEST_FULLURL: http://localhost/signserver/process?null; FILENAME: document.pdf; LOG_ID: 60961c2a-d005-4f19-a7bf-d74bb30c0448; REPLY_TIME:1605998099578

Any suggestions

OS version: Windows Server 2016
Java: OpenJDK 8.0.242.08 Ant: ant 1.9.14
Database: MariaDB 10.4.12
Server: Wildfly 10.1.0
Signserver Version: 5.2.0

Token is activated and and have auto-activation feature enter image description here

user2426998
  • 483
  • 5
  • 20

1 Answers1

0

Since you did not enable auto-activation of the crypto token. Did you enable the crypto token and worker before sending a signing request?

primetomas
  • 524
  • 2
  • 5
  • I have enabled the crypto token and worker before sending a signing request also I enabled token for timestamp too. Do you think auto-activation is a problem? – user2426998 Nov 24 '20 at 13:37
  • Your properties file looks very strange. You have multiple properties overriding each other, like "WORKERGENID1.NAME". I think you should use one properties file for each worker. If you are unsure, start with only a single PDF worker without timestamping, so you work one step at a time. – primetomas Nov 25 '20 at 12:19
  • These are multiple properties. to be exact one keystore works for timestamp and another one works for PDF Signer. Can one keystore work for others given that certificat will have both timestamping and PDF signing designations? – user2426998 Nov 25 '20 at 13:19
  • As I added token is Autoactivated and active. – user2426998 Nov 25 '20 at 23:13
  • Your screenshot shows a crypto token in EJBCA while your log is from SignServer. These are different softwares. A crypto token in EJBCA is not used by SignServer (and vice versa), you have to activate crypto tokens in SignServer. See for example this documentation: https://doc.primekey.com/signserver520/signserver-reference/signserver-user-interfaces/administration-web/workers-page/worker-page/worker-crypto-token-page – primetomas Nov 26 '20 at 10:23
  • This is what i get after doing that. It is not active because somehow certificate chain isn't available but it is available. Could you reference specific guide for this errors? https://pastebin.com/Fip2DUBZ – user2426998 Nov 26 '20 at 17:43
  • The error first says that your key is not available, which means you have configued to use a signing key that is not present in the P12 file that you have configured. This is on more than one signer. I would take one step back from here and start over, doing one worker at a time, following the operations guide. https://doc.primekey.com/signserver520/signserver-operations/worker-setup In your case you start with creating a time stamp signer, ensuring that that works. After that create the PDF signer. – primetomas Nov 27 '20 at 06:35
  • Is there any reference where i can find how to make PKCS#12 Keystore with certificate for signserver with EJBCA? – user2426998 Nov 27 '20 at 22:58
  • It's in the SignServer documentation. There are several ways. You can just create a P12 from EJBCA, but you have to use the right aliases when configuring it in SignServer. Another way is to create a crypto token in SIgnServer, then you create a CSR from SignServer, take it to EJBCA, issue the certifiate and then import the certificate in SignServer. For some detailed Howto, you can follow the EE howto guide. Should be usable in CE as well. https://doc.primekey.com/signserver/code-signing-how-to-guides – primetomas Nov 30 '20 at 08:47
  • I created a keystore from ejbca Public Web after making all prerequisites in the admin. I used this manual https://download.primekey.se/docs/EJBCA-Enterprise/latest/Issue_a_new_PKCS_12_keystore_for_an_SSL_server.html but got result: `- No key available for purpose: signer00002 - Certificate chain not available` The manual you linked is irrelevant as we can't access web in CE. Do you have something like that for CE? – user2426998 Dec 05 '20 at 00:40
  • You can use the CLI in CE. You issue is that there is no alias signer00002 in the p12 file you have downloaded. You can investigate the contents of the p12 file with for example an OpenSSL command "openssl pkcs12 -in file.p12". This will print the aliases that are in the p12 file, and then you need to use those aliases in the signer setup. – primetomas Dec 07 '20 at 15:36
  • Did you try this quick start guide? https://doc.primekey.com/signserver520/signserver-operations/worker-setup/quick-start-demo-setup-using-administration-cli – primetomas Dec 07 '20 at 15:37
  • Is friendly Name an alias? Yeah I tried that quick start guide and it worked okay. – user2426998 Dec 07 '20 at 21:22
  • yes what's called friendlyName on openssl is an alias in SignServer/Java. – primetomas Dec 08 '20 at 15:41