Generating CMC Shared Token

Overview

This page describes the process to generate a CMC shared token for issuing a user certificate.

It assumes that:

• Issuance protection certificate has been created.

Generating Shared Token

$ CMCSharedToken \
    -d /root/.dogtag/nssdb \
    -p "" \
    -n issuance_protection \
    -s <token> \
    -o testuser.b64

$ sed -i -e :a -e 'N;s/\n//;ba' testuser.b64
$ SHARED_TOKEN=$(cat testuser.b64)

Adding Shared Token for User

$ ldapmodify \
    -H ldap://ds.example.com:3389 \
    -x \
    -D "cn=Directory Manager" \
    -w Secret.123 \
    << EOF
dn: uid=testuser,ou=people,dc=example,dc=com
changetype: modify
add: objectClass
objectClass: extensibleobject
-
add: shrTok
shrTok: $SHARED_TOKEN
-
EOF

See Also

• PKI 10.5 CMC Shared Token