<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Glad to see with KEA 2.0 and Stork 0.2x that we can now use TLS to secure the transactions between the Stork server and the Agent, and between the Agent and KEA.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m trying to use server certificates signed by my organization certification authority instead of the self-signed certificates that Stork is proposing. To that effect, I’ve declared the trust-anchor, cert-file and key-file attributes in
the KEA Control Agent pointing respectively to the Certification Authority certificate PEM file, the server certificate (and the certificate chain to the CA), and the server certificate private key (with the certificate chain to the certificate authority in
the same PEM file). <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m trying to load the same certificates in Stork using the stork-tool, and no issue for the CA cert and the SRV Cert, but I can’t get to load the server private key. The stork-tool call fails saying “main.go:333 problem parsing the
server key: parsing private key: x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)”. I know the private key file is the right one for the server certificate (checked them with the usual openssl x509/rsa -modulus | md5
routine), and all three CA certificate, server certificate and key files work OK with kea-shell…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The PEM file for the private key starts with “-----BEGIN RSA PRIVATE KEY-----". When I export the private key that Stork self-generated, it says “BEGIN PRIVATE KEY”. I’ve tried converting the private key to PKCS8 format, but then getting
other errors and stork-tool crashing with “panic: interface conversion: interface {} is *rsa.PrivateKey, not *ecdsa.PrivateKey”.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Anyone succeeded in specifying keys across Stork and KEA successfully?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="color:#0568AE">Bertrand Buclin<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span style="color:#0D0D0D">Director, Access Technology Management<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="color:#0D0D0D">Global Connectivity Management<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="color:#0568AE">AT&T Global Network Services (Switzerland) GmbH<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span style="color:#0D0D0D">m +41 79 333 00 20 |
<a href="mailto:bbuclin@att.com">bbuclin@att.com</a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>