I recently started using EJBCA to set up a PKI in a project I am working on. I decided to use the Bitnami EJBCA container (which is similar to PrimeKey container but it has a package manager). I set up everything successfully but now I need to find a way to issue certificates via console (in order to automate it in the future).
For that I carried out the following steps:
I downloaded the p12 file for superadmin to access the admin page: https://localhost:8443/ejbca/adminweb (Note that it is in localhost as it is a container with exposed ports)
I created a csr in order to test the certificate issuing
I created a end entity profile that only requires serialnumber as CN
I created an end entity named test and batch created its p12 file
Now I try to execute the ClientToolBox with the following command:
./ejbcaClientToolBox.sh EjbcaWsRaCli pkcs10req test test ./csr.csr PEM cert.cert
where csr.csr is the CSR and cert.cert is the output certificate.
the configuration I have for the tool is the following:
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
That means that the server you are connecting to, does not use the hostname "localhost" in it's TLS server certificate. Check the TLS certificate of the server, and configure ejbcawsracli.properties to use the hostname the server claims to have in the WS URL.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
If you go in your web browser to the admin Web you can inspect the certificate.
Click on the padlock->connection secure (or not secure)->more information->view certificate, check the "common name" value.
Thank you very much for your help, I managed to solve the issue. Now I tried to execute again the same command, but unfortunately I got another error, this time regarding the access rules (or at least I think so).
The role access rules seems to have Deny on everything except Administrator, so that role will not be able to issue a certificate from a CSR.
For the role, you mean the certificate serial number is the one on your p12 file? The other entry with "CLI" is only a username/password member, for running the local CLI (ejbca.sh).
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi Santiago, sorry to contact you, but I am facing exactly the same problems you had with the EJBCA.
Could you tell me please, the steps you had to do with your certitifcate to go around your problem?
I would apreciate you for a soon response.
Thank you!
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Many things have been discussed in this thread. Could you please point me to the precise problem you have right now? I would be glad to help if I'm able to.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi,
I recently started using EJBCA to set up a PKI in a project I am working on. I decided to use the Bitnami EJBCA container (which is similar to PrimeKey container but it has a package manager). I set up everything successfully but now I need to find a way to issue certificates via console (in order to automate it in the future).
For that I carried out the following steps:
Now I try to execute the ClientToolBox with the following command:
./ejbcaClientToolBox.sh EjbcaWsRaCli pkcs10req test test ./csr.csr PEM cert.certwhere csr.csr is the CSR and cert.cert is the output certificate.
the configuration I have for the tool is the following:
I get the following error:
I suppose that the error is because the p12 file (which it's CN is probably not localhost) but I need guidance in how to create a proper p12 file.
Best Regards,
Your issue is a classic TLS connection issue:
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
That means that the server you are connecting to, does not use the hostname "localhost" in it's TLS server certificate. Check the TLS certificate of the server, and configure ejbcawsracli.properties to use the hostname the server claims to have in the WS URL.
Dear Tomas,
First of all, thank you for your fast reply.
Please forgive my ignorance, but I'm not sure on how to check the WS URL on the TLS certificate.
What I'm checking is the certificate I get when connecting to the adminweb via the browser.
Can you please extend a bit more how to check the hostname on the certificate?
Best Regards,
EDIT:
Dear Tomas,
I tried now with another server and creating another user, with no success. I still have the same error.
The content of the certificate used is the following:
As you can see, the IP used (10.11.1.31) is in the Alternative Names part.
Any idea?
Best Regards,
Last edit: Santiago 2021-10-07
If you go in your web browser to the admin Web you can inspect the certificate.
Click on the padlock->connection secure (or not secure)->more information->view certificate, check the "common name" value.
See screenshots.
Dear Tomas,
Thank you very much for your help, I managed to solve the issue. Now I tried to execute again the same command, but unfortunately I got another error, this time regarding the access rules (or at least I think so).
The error is the following:
The content of the configuration file is the following:
I think it's strange, because the user registrator is in a role with the following access rules (see screenshots).
Thanks again for your help and best regards,
The role access rules seems to have Deny on everything except Administrator, so that role will not be able to issue a certificate from a CSR.
For the role, you mean the certificate serial number is the one on your p12 file? The other entry with "CLI" is only a username/password member, for running the local CLI (ejbca.sh).
Thank you Tomas, after trying a few things I discovered the error as an internal configuration problem with the certificate. Now everything is fine.
Hi Santiago, sorry to contact you, but I am facing exactly the same problems you had with the EJBCA.
Could you tell me please, the steps you had to do with your certitifcate to go around your problem?
I would apreciate you for a soon response.
Thank you!
Hi Raul,
Many things have been discussed in this thread. Could you please point me to the precise problem you have right now? I would be glad to help if I'm able to.