Re: Including custom X.509 extension upon proxy renewal
Jim Basney schrieb:
> Christopher Kunz <kunz@rvs.uni-hannover.de> wrote:
>> Looks like the request is not actually filled with parameters yet. What is my
>> mistake here?
>
> Looks OK to me. Most of the parameters come from the issuer certificate
> when the request is signed by globus_gsi_proxy_sign_req().
>
> -Jim
I worked around the issue - in a very clumsy way, though.
I couldn't figure out what to do with that empty request and while checking the
sources of globus_gsi_proxy_sign_req and its helper function
globus_l_gsi_proxy_sign_key, I found that the proxy_handle->req property isn't
really used at all. So I copied those two functions into my ssl_utils.c (yeah, I
know, very ugly... it's a prototype implementation!), changed the headers and
I'm now adding my custom extension within the modified
globus_l_gsi_proxy_sign_key function.
That works. Kinda. However, this is of course not portable at all and only
sufficient for our very limited lab "proof of concept" conditions. I wonder
which is the programmatically correct solution to achieve the goal of adding a
custom extension to a certificate request before re-signing it?
Regards,
--ck