I use the following command to get a signed certificate from PKI.
What is the content of the file srvcert.crt of the option -srvcert ? It seems the srvcert.crt file is not the public certificate of the pki_server. Indeed, I tried with it and it does not work.
openssl cmp -cmd ir -server pki_server:8040 \ -path signing-cmp/test -cert /tmp/mycert.crt \ -key /tmp/mycert.key -newkey /tmp/new.key \ -subject '/C=FR/CN=domain.com/ST=London/L=London/O=Organization/OU=IT Administration' \ -certout /tmp/new.crt -srvcert /tmp/srvcert.crt
Here is how got the public certificate of the PKI. The option -srvcert does not work with this file.
echo -n | openssl s_client -showcerts -connect pki_server:443 \ 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /tmp/srvcert.crt