Creating a CSR via the web interface

[lhpaladin]

Dear all,

I am trying to set up an option in my portal for users to create a certificate using a local CA (OpenSSL). I created it via pi-manager, and everything appeared on the privacyIDEA server. After adjusting the CRL parameters, I was able to assign a CSR using the Admin interface.

However, a standard user cannot do the same. The policy allowing certificate enrollment exists, but upon reaching the enrollment screen, the following issues occur:

Default UI:

When clicking “Enroll,” the following message appears: “The minimum OTP PIN length is 6.”

New UI:

The OTP PIN field is visible; however, even after filling in all the information, the “Enroll Token” button does not become active.

Thanks to anyone who can help.

[lhpaladin]

The behavior in the default UI appears to be the same as described here:

Private Key Passphrase when importing .p12-File into Windows 10

Hi all, the Import-Manager of Windows 10 asks for a passphrase of the private key, after downloading an enrolled certificate-token. I just created a local test-CA; enrolled a certificate for a user and downloaded the pkcs12-File. Does privacyIDEA encrypt the private key with a certain passphrase by default? Kind regards Axel Czuck

The OTP PIN field is not visible.

[cornelinux]

With certificates the OTP PIN is used as the passphrase for the p12 file.

So if you are first creating a CSR, then an OTP PIN will not be used, yet, since there might not be a p12, yet.
Please remove your PIN length policy in this case and check again.

[lhpaladin]

Thanks @cornelinux,

In the standard UI, setting otp_pin_minlength to 0 and disabling otp_pin_contents worked.

In the new UI, token registration still fails to activate the button.

Is it possible to set the PIN length for specific token types only? I tried setting tokentype == 'certificate' as a condition, but it didn’t work.