pkiDebug
pkiDebug("pkinit_client_process: returning %d (%s)\n",
pkiDebug("No request->client; aborting PKINIT\n");
pkiDebug("pkinit_client_tryagain %p %p %p %p\n",
pkiDebug("failed to decode sequence of trusted certifiers\n");
pkiDebug("failed to decode td_dh_parameters\n");
pkiDebug("pkinit_get_kdc_cert returned %d\n", retval);
pkiDebug("pkinit_client_tryagain: returning %d (%s)\n",
pkiDebug("encode_krb5_kdc_req_body returned %d\n", (int) retval);
pkiDebug("%s: returning reqctx at %p\n", __FUNCTION__, reqctx);
pkiDebug("%s: received reqctx at %p\n", __FUNCTION__, reqctx);
pkiDebug("%s: Bad magic value (%x) in req ctx\n",
pkiDebug("%s: returning plgctx at %p\n", __FUNCTION__, ctx);
pkiDebug("pkinit_lib_fini: got bad plgctx (%p)!\n", ctx);
pkiDebug("%s: got plgctx at %p\n", __FUNCTION__, ctx);
pkiDebug("(pkinit) received '%s' = '%s'\n", attr, value);
pkiDebug("error %d on pkinit_as_req_create; aborting PKINIT\n",
pkiDebug("pkinit_as_req_create pa_type = %d\n", reqctx->pa_type);
pkiDebug("failed to create dh parameters\n");
pkiDebug("failed to encode the AuthPack %d\n", retval);
pkiDebug("failed to create pkcs7 signed data\n");
pkiDebug("pkinit_as_req_create retval=%d\n", (int) retval);
pkiDebug("pa_pkinit_parse_rep: no in_padata\n");
pkiDebug("pkinit_as_rep_parse returned %d (%s)\n",
pkiDebug("%s: No pkinit_kdc_hostname values found in config file\n",
pkiDebug("%s: pkinit_kdc_hostname values found in config file\n",
pkiDebug("%s: error from retrieve_certificate_sans()\n", __FUNCTION__);
pkiDebug("%s: Checking pkinit sans\n", __FUNCTION__);
pkiDebug("%s: pkinit san match found\n", __FUNCTION__);
pkiDebug("%s: no pkinit san match found\n", __FUNCTION__);
pkiDebug("%s: no certhosts (or we wouldn't accept them anyway)\n",
pkiDebug("%s: comparing cert name '%s' with config name '%s'\n",
pkiDebug("%s: we have a dnsName match\n", __FUNCTION__);
pkiDebug("%s: no dnsName san match found\n", __FUNCTION__);
pkiDebug("%s: returning retval %d, valid_san %d, need_eku_checking %d\n",
pkiDebug("%s: configuration requests no EKU checking\n", __FUNCTION__);
pkiDebug("%s: Error from crypto_check_cert_eku %d (%s)\n",
pkiDebug("%s: returning retval %d, eku_accepted %d\n",
pkiDebug("decode_krb5_as_rep failed %d\n", retval);
pkiDebug("unknown as_rep type %d\n", kdc_reply->choice);
pkiDebug("failed to verify pkcs7 signed data\n");
pkiDebug("%s: did not find an acceptable SAN in KDC certificate\n",
pkiDebug("%s: did not find an acceptable EKU in KDC certificate\n",
pkiDebug("%s: skipping EKU check\n", __FUNCTION__);
pkiDebug("failed to decode kdc_dh_key_info\n");
pkiDebug("failed to process dh params\n");
pkiDebug("pkinit_kdf failed: %s\n", error_message(retval));
pkiDebug("pkinit_as_rep_parse returning %d (%s)\n",
pkiDebug("pkinit_client_profile %p %p %p %p\n",
pkiDebug("%s: Invalid value for pkinit_eku_checking: '%s'\n",
pkiDebug("pkinit_identity_initialize returned %d (%s)\n",
pkiDebug("%s: not asking responder question\n", __FUNCTION__);
pkiDebug("%s: no questions to ask\n", __FUNCTION__);
pkiDebug("%s: asking question '%s'\n", __FUNCTION__, encoded);
pkiDebug("%s returning %d\n", __FUNCTION__, retval);
pkiDebug("%s: \"%s\": %p\n", data->caller, key, password);
pkiDebug("pkinit_client_parse_answers: %s\n", encoded);
pkiDebug("pkinit_client_process %p %p %p %p\n",
pkiDebug("processing KRB5_PADATA_PK_AS_REQ\n");
pkiDebug("processing KRB5_PADATA_PK_AS_REP\n");
pkiDebug("unrecognized patype = %d for PKINIT\n",
pkiDebug("pkinit responder answers were invalid\n");
pkiDebug("kdc_options = 0x%x till = %d\n",
pkiDebug("pkinit_identity_prompt returned %d (%s)\n",
pkiDebug("pkinit_identity_prompt previously returned %d (%s)\n",
pkiDebug("%s: initializing openssl crypto context at %p\n",
pkiDebug("%s: freeing context at %p\n", __FUNCTION__, cryptoctx);
pkiDebug("%s: returning ctx at %p\n", __FUNCTION__, ctx);
pkiDebug("%s: freeing ctx at %p\n", __FUNCTION__, idctx);
pkiDebug("%s: returning ctx at %p\n", __FUNCTION__, ctx);
pkiDebug("%s: freeing ctx at %p\n", __FUNCTION__, req_cryptoctx);
pkiDebug("failed to read certificate from %s\n", filename);
pkiDebug("failed to read private key from %s\n", filename);
pkiDebug("building certificate chain\n");
pkiDebug("Expected id-signedData CMS msg (received type = %d)\n",
pkiDebug("unable to find any trusted CAs\n");
pkiDebug("untrusted cert chain of size %d\n", size);
pkiDebug("cert #%d: %s\n", i, buf);
pkiDebug("trusted cert chain of size %d\n", size);
pkiDebug("cert #%d: %s\n", i, buf);
pkiDebug("CRL chain of size %d\n", size);
pkiDebug("crls by CA #%d: %s\n", i , buf);
pkiDebug("problem with cert DN = %s (error=%d) %s\n", buf, j,
pkiDebug("received cert chain of size %d\n", size);
pkiDebug("cert #%d: %s\n", j, buf);
pkiDebug("CMS Verification successful\n");
pkiDebug("wrong oid in eContentType\n");
pkiDebug("create_identifiers_from_stack failed\n");
pkiDebug("encode_krb5_td_trusted_certifiers failed\n");
pkiDebug("%s: nowhere to return any values!\n", __FUNCTION__);
pkiDebug("%s: no certificate!\n", __FUNCTION__);
pkiDebug("%s: failed decoding pkinit san value\n",
pkiDebug("%s: unrecognized othername oid in SAN\n",
pkiDebug("%s: found dns name = %s\n", __FUNCTION__,
pkiDebug("%s: failed to duplicate dns name\n",
pkiDebug("%s: SAN type = %d expecting %d\n", __FUNCTION__,
pkiDebug("%s: No certificate!\n", __FUNCTION__);
pkiDebug("%s: found eku info in the cert\n", __FUNCTION__);
pkiDebug("%s: checking eku %d of %d, allow_secondary = %d\n",
pkiDebug("%s: returning retval %d, valid_eku %d\n",
pkiDebug("client computed key (%d)= ", client_key_len);
pkiDebug("failed to decode dhparams\n");
pkiDebug("create_krb5_trustedCertifiers failed\n");
pkiDebug("create_krb5_invalidCertificates failed\n");
pkiDebug("encode_krb5_td_trusted_certifiers failed\n");
pkiDebug("found kdcPkId in AS REQ\n");
pkiDebug("dh parameters\n");
pkiDebug("cert = %s\n", buf);
pkiDebug("callback function: %d (%s)\n", err, errmsg);
pkiDebug("open_session: slotid %d (%lu of %d)\n", (int)cctx->slotid,
pkiDebug("failed to create the signature\n");
pkiDebug("%s: failed to get user's cert location\n", __FUNCTION__);
pkiDebug("%s: failed to get user's private key location\n", __FUNCTION__);
pkiDebug("%s: failed to get user's cert location\n", __FUNCTION__);
pkiDebug("cert: size %d, id %d, idlen %d\n", (int)attrs[0].ulValueLen,
pkiDebug("Failed to convert certid string [%s]\n",
pkiDebug("%s: EKUs not requested, not checking\n", __FUNCTION__);
pkiDebug("%s: returning eku 0x%08x\n", __FUNCTION__, eku_bits);
pkiDebug("%s: KUs not requested, not checking\n", __FUNCTION__);
pkiDebug("%s: returning ku 0x%08x\n", __FUNCTION__, ku_bits);
pkiDebug("%s: crypto_cert_get_matching_data error %d, %s\n",
pkiDebug("%s: error reading file '%s'\n", __FUNCTION__, filename);
pkiDebug("#%d cert= %s\n", i, buf);
pkiDebug("received trusted certifiers\n");
pkiDebug("received invalid certificate\n");
pkiDebug("#%d cert = %s is trusted by kdc\n", i, buf);
pkiDebug("#%d cert = %s is invalid\n", i, buf);
pkiDebug("#%d issuer = %s serial = %ld is trusted bu kdc\n", i,
pkiDebug("#%d issuer = %s serial = %ld is invalid\n", i, buf,
pkiDebug("%s: cert_filename '%s' key_filename '%s'\n",
pkiDebug("%s: Unsupported type while processing '%s'\n",
pkiDebug("%s: idtype is %s\n", __FUNCTION__, idtype2string(idopts->idtype));
pkiDebug("%s: processing catype %s, value '%s'\n",
pkiDebug("No type given for '%s'\n", value);
pkiDebug("%s: %p %p %p\n", __FUNCTION__, context, idopts, id_cryptoctx);
pkiDebug("%s: no user identity options specified\n", __FUNCTION__);
pkiDebug("%s: %p %p %p\n", __FUNCTION__, context, idopts, id_cryptoctx);
pkiDebug("%02x ", buf[i]);
pkiDebug("\n");
pkiDebug("%s: Missing or empty value for list keyword type %d\n",
pkiDebug("%s: Unknown list keyword type %d\n", __FUNCTION__, type);
pkiDebug("%s: Found value '%s', bitfield is now 0x%x\n",
pkiDebug("%s: Urecognized value '%s'\n", __FUNCTION__, value);
pkiDebug("%s: returning %d\n", __FUNCTION__, retval);
pkiDebug("%s: Missing or invalid keyword in rule '%s'\n",
pkiDebug("%s: found keyword '%s'\n", __FUNCTION__, kw->value);
pkiDebug("%s: Missing value for keyword '%s'\n",
pkiDebug("%s: found value '%s'\n", __FUNCTION__, value);
pkiDebug("%s: Error compiling reg-exp '%s': %s\n",
pkiDebug("%s: Error %d, parsing list values for keyword %s\n",
pkiDebug("%s: returning %d\n", __FUNCTION__, retval);
pkiDebug("%s: Assuming AND relation for multiple components in rule '%s'\n",
pkiDebug("%s: After parse_rule_component, remaining %d, rule '%s'\n",
pkiDebug("%s: returning %d\n", __FUNCTION__, retval);
pkiDebug("%s: keyword %s, keyword value %s mismatch\n",
pkiDebug("%s: checking %s: rule 0x%08x, cert 0x%08x\n",
pkiDebug("%s: checking %s: rule 0x%08x, cert 0x%08x\n",
pkiDebug("%s: keyword %s, keyword value %s mismatch\n",
pkiDebug("%s: unknown keyword value type %d\n",
pkiDebug("%s: returning match = %d\n", __FUNCTION__, match);
pkiDebug("%s: matching rule relation is %s with %d components\n",
pkiDebug("%s: subject: '%s'\n", __FUNCTION__, md->subject_dn);
pkiDebug("%s: match for keyword type %s\n",
pkiDebug("%s: cert matches rule (OR relation)\n",
pkiDebug("%s: cert does not match rule (AND relation)\n",
pkiDebug("%s: cert matches rule (AND relation)\n", __FUNCTION__);
pkiDebug("%s: returning %d, match_found %d\n",
pkiDebug("%s: no matching rules found in config file\n", __FUNCTION__);
pkiDebug("%s: Error %d obtaining certificate information\n",
pkiDebug("%s: Error %d, checking certs against rule '%s'\n",
pkiDebug("%s: We have an exact match with rule '%s'\n",
pkiDebug("%s: Selecting the matching cert!\n", __FUNCTION__);
pkiDebug("%s: crypto_cert_select error %d, %s\n",
pkiDebug("%s: Invalid value for pkinit_eku_checking: '%s'\n",
pkiDebug("%s: returning context at %p for realm '%s'\n",
pkiDebug("%s: unable to find realm context for realm '%.*s'\n",
pkiDebug("%s: initializing context at %p for realm '%s'\n",
pkiDebug("pkinit_create_edata: creating edata for error %d (%s)\n",
pkiDebug("%s: returning context at %p for realm '%s'\n",
pkiDebug("no edata needed for error %d (%s)\n",
pkiDebug("%s: returning context at %p\n", __FUNCTION__, moddata);
pkiDebug("%s: returning reqctx at %p\n", __FUNCTION__, reqctx);
pkiDebug("pkinit_fini_kdc_req_context: got bad reqctx (%p)!\n", reqctx);
pkiDebug("%s: freeing reqctx at %p\n", __FUNCTION__, reqctx);
pkiDebug("pkinit_server_get_edata: entered!\n");
pkiDebug("%s: error from retrieve_certificate_sans()\n", __FUNCTION__);
pkiDebug("%s: Checking pkinit sans\n", __FUNCTION__);
pkiDebug("%s: Comparing client '%s' to pkinit san value '%s'\n",
pkiDebug("%s: no pkinit san match found\n", __FUNCTION__);
pkiDebug("%s: no upn sans (or we wouldn't accept them anyway)\n",
pkiDebug("%s: Checking upn sans\n", __FUNCTION__);
pkiDebug("%s: Comparing client '%s' to upn san value '%s'\n",
pkiDebug("%s: no upn san match found\n", __FUNCTION__);
pkiDebug("%s: returning retval %d, valid_san %d\n",
pkiDebug("%s: Error from crypto_check_cert_eku %d (%s)\n",
pkiDebug("%s: returning retval %d, eku_accepted %d\n",
pkiDebug("pkinit_verify_padata: entered!\n");
pkiDebug("unrecognized pa_type = %d\n", data->pa_type);
pkiDebug("decode_krb5_pa_pk_as_req failed\n");
pkiDebug("failed to decode krb5_auth_pack\n");
pkiDebug("bad dh parameters\n");
pkiDebug("kdcPkId in AS_REQ does not match KDC's cert; "
pkiDebug("pkinit_verify_padata failed: creating e-data\n");
pkiDebug("pkinit_create_edata failed\n");
pkiDebug("missing request context \n");
pkiDebug("Unable to locate correct realm context\n");
pkiDebug("KDC picked etype = %d\n", enctype);
pkiDebug("failed to process/create dh parameters\n");
pkiDebug("%s: freeing context at %p\n", __FUNCTION__, realm_contexts);
pkiDebug("encode_krb5_kdc_dh_key_info failed\n");
pkiDebug("failed to create pkcs7 signed data\n");
pkiDebug("pkinit_pick_kdf_alg failed: %s\n",
pkiDebug("failed to encode AS_REP\n");
pkiDebug("pkinit_kdf failed: %s\n", error_message(retval));
pkiDebug("pkinit_verify_padata failure");
pkiDebug("%s: entered for realm %s\n", __FUNCTION__, plgctx->realmname);