You can subscribe to this list here.
2001 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
(3) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2002 |
Jan
(3) |
Feb
(2) |
Mar
(8) |
Apr
(3) |
May
(6) |
Jun
(1) |
Jul
(15) |
Aug
(6) |
Sep
|
Oct
(10) |
Nov
(2) |
Dec
(4) |
2003 |
Jan
(1) |
Feb
(7) |
Mar
(3) |
Apr
(6) |
May
(7) |
Jun
(5) |
Jul
(5) |
Aug
(25) |
Sep
(14) |
Oct
(2) |
Nov
|
Dec
(2) |
2004 |
Jan
(7) |
Feb
(4) |
Mar
(12) |
Apr
(16) |
May
(43) |
Jun
(56) |
Jul
(43) |
Aug
(40) |
Sep
(66) |
Oct
(12) |
Nov
(26) |
Dec
(10) |
2005 |
Jan
(13) |
Feb
(33) |
Mar
(16) |
Apr
(7) |
May
(10) |
Jun
(34) |
Jul
(41) |
Aug
(8) |
Sep
(4) |
Oct
(32) |
Nov
(20) |
Dec
(25) |
2006 |
Jan
(30) |
Feb
(101) |
Mar
(5) |
Apr
(75) |
May
(74) |
Jun
(22) |
Jul
(6) |
Aug
(70) |
Sep
(19) |
Oct
(21) |
Nov
(31) |
Dec
(50) |
2007 |
Jan
(15) |
Feb
(20) |
Mar
(24) |
Apr
(33) |
May
(13) |
Jun
(18) |
Jul
(13) |
Aug
(7) |
Sep
(63) |
Oct
(68) |
Nov
(29) |
Dec
(68) |
2008 |
Jan
(30) |
Feb
(33) |
Mar
(30) |
Apr
(103) |
May
(78) |
Jun
(48) |
Jul
(72) |
Aug
(24) |
Sep
(62) |
Oct
(63) |
Nov
(70) |
Dec
(37) |
2009 |
Jan
(34) |
Feb
(35) |
Mar
(64) |
Apr
(34) |
May
(34) |
Jun
(58) |
Jul
(30) |
Aug
(30) |
Sep
(46) |
Oct
(52) |
Nov
(12) |
Dec
(23) |
2010 |
Jan
(121) |
Feb
(18) |
Mar
(53) |
Apr
(62) |
May
(62) |
Jun
(20) |
Jul
(33) |
Aug
(20) |
Sep
(36) |
Oct
(35) |
Nov
(44) |
Dec
(63) |
2011 |
Jan
(19) |
Feb
(32) |
Mar
(94) |
Apr
(41) |
May
(47) |
Jun
(25) |
Jul
(34) |
Aug
(20) |
Sep
(9) |
Oct
(41) |
Nov
(33) |
Dec
(24) |
2012 |
Jan
(12) |
Feb
(36) |
Mar
(48) |
Apr
(32) |
May
(20) |
Jun
(15) |
Jul
(32) |
Aug
(13) |
Sep
(33) |
Oct
(54) |
Nov
(25) |
Dec
(16) |
2013 |
Jan
(45) |
Feb
(39) |
Mar
(38) |
Apr
(50) |
May
(29) |
Jun
(30) |
Jul
(33) |
Aug
(12) |
Sep
(9) |
Oct
(25) |
Nov
(29) |
Dec
(20) |
2014 |
Jan
(25) |
Feb
(19) |
Mar
(16) |
Apr
(33) |
May
(27) |
Jun
(37) |
Jul
(29) |
Aug
(27) |
Sep
(37) |
Oct
(58) |
Nov
(109) |
Dec
(26) |
2015 |
Jan
(4) |
Feb
(35) |
Mar
(22) |
Apr
(35) |
May
(28) |
Jun
(20) |
Jul
(4) |
Aug
(16) |
Sep
(37) |
Oct
(13) |
Nov
(13) |
Dec
(14) |
2016 |
Jan
(22) |
Feb
(7) |
Mar
(23) |
Apr
(30) |
May
(10) |
Jun
(10) |
Jul
(15) |
Aug
(12) |
Sep
(22) |
Oct
(31) |
Nov
(5) |
Dec
(5) |
2017 |
Jan
(30) |
Feb
(25) |
Mar
(28) |
Apr
(4) |
May
(19) |
Jun
(13) |
Jul
(7) |
Aug
(1) |
Sep
(2) |
Oct
(5) |
Nov
(12) |
Dec
(2) |
2018 |
Jan
(7) |
Feb
|
Mar
(7) |
Apr
(2) |
May
(8) |
Jun
(18) |
Jul
(6) |
Aug
(3) |
Sep
(15) |
Oct
(33) |
Nov
(13) |
Dec
(7) |
2019 |
Jan
(5) |
Feb
(7) |
Mar
(30) |
Apr
(5) |
May
(4) |
Jun
(69) |
Jul
(86) |
Aug
(22) |
Sep
(6) |
Oct
(7) |
Nov
(5) |
Dec
(3) |
2020 |
Jan
(10) |
Feb
(12) |
Mar
(22) |
Apr
(5) |
May
(1) |
Jun
(4) |
Jul
(6) |
Aug
|
Sep
(9) |
Oct
|
Nov
|
Dec
(1) |
2021 |
Jan
(4) |
Feb
(11) |
Mar
(7) |
Apr
(7) |
May
|
Jun
(3) |
Jul
(10) |
Aug
(6) |
Sep
|
Oct
|
Nov
(18) |
Dec
(2) |
2022 |
Jan
(1) |
Feb
(1) |
Mar
|
Apr
|
May
|
Jun
(2) |
Jul
|
Aug
(4) |
Sep
|
Oct
|
Nov
|
Dec
|
2023 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
(1) |
Jun
|
Jul
|
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Tomas G. <tom...@pr...> - 2021-11-12 09:56:39
|
Great findings Arwyn, One thing perhaps that you may consider is to use the WS API, where clientToolBox has a CLI. You can perform the three commands you list using the local CLI with a single WS/WS CLI command if using a CSR: ./ejbcaClientToolBox.sh EjbcaWsRaCli certreq Or multiple commands as well if issuing keystores (pkcs12), with your "own" WS client you can do other things as well. The WS API may be faster if it's the CLI remote EJB commands that are slower in newer WildFly. Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...> Sent: Thursday, November 11, 2021 3:43 PM To: Tomas Gustavsson <tom...@pr...>; ejb...@li... <ejb...@li...> Subject: RE: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Thanks Tomas, I currently do not believe the slow down is caused by the EJBCA or cesecore server side. I turned on trace logging for only ejbca and cesecore loggers on the server side. All of these log messages appeared within 0.75 seconds of each other for EJBCA6 and within 0.85 seconds of each other for EJBCA7. This means I don’t think there has been a significant change to the server side performance of EJBCA or cesecore logic. When running a bin/ejbca.sh command I have observed the client ejbca.sh JVM startup time to be very similar in both versions of EJBCA, at around 1 second. In the case of EJBCA 6, the EJBCA and cesecore log messages show up ~ 0.5 seconds after the JVM has fully started up. In the case of EJBCA 7 the EJBCA and cesecore log messages show up ~ 1.7 seconds after the JVM has started up. This makes me think that either the client is slower by ~1.2 seconds in the new version, or there is some slow down in wildfly and the EJBRemoteInvocation. This gives the total time for one ejbca.sh command to go from ~2.25 seconds in EJBCA 6 to ~3.55, with most of this difference coming from the change in the client. (I believe changing the logging levels have had a slight effect on the performance, which is why these values are different to my original comment). Over a typical certificate renewal I would call the ejbca.sh command three separate times. The three commands I run would be bin/ejbca.sh ra setendentitystatus --username " user.name" -S 10 bin/ejbca.sh ra setpwd --username "user.name” --password “password” bin/ejbca.sh createcert --username “user.name” –password “password” -c “/tmp/tmp_csr” -f “/opt/ejbca/p12/pem/user.name.pem” As the server typically takes less than a second to respond, the change to the client performance is resulting in this process taking between 1.5 and 2 times longer than previously. I’ve been having some trouble running the stress test tool but I will try to get results from that to confirm the client is the issue. You mention that the stress test tool is able to run without having to restart the JVM. This leads me to thinking that it may be possible to follow the same pattern when running my certificate renewal. Is it possible to run multiple bin/ejbca.sh commands without restarting the JVM? If the JVM is reused, it may mean that the slow down in the client that I have observed would not have such a large effect over a typical workflow. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...> Sent: 11 November 2021 09:39 To: Launchbury, Arwyn <Arw...@nc...>; ejb...@li... Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Can you rule out that it is anything on the client side that is slow? For performance measurement of EJBCA itself, we typically run a "clientToolBox stress" which is a nice stress test tool that runs multiple threads in a single client JVM, avoiding any JVM loading issues, and showing certificate issuance speed. You can test single threaded performance (measure latency) and multi-threaded performance measuring throughput. This tool has been available since EJBCA 4 and can be used throughout the times. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/command-line-interfaces/ejbca-client-toolbox<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fdoc.primekey.com%2Fejbca%2Fejbca-operations%2Fejbca-operations-guide%2Fcommand-line-interfaces%2Fejbca-client-toolbox__%3B!!In4Qlw!8nNxnuGaxSyzwunRmKOIxMC8KZxIMaueNRWOVicq6Xa0vGl-oyFya0kknO7Le8vlvqY%24&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C99b31a6ee64c405a7c0608d9a521b651%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637722386517929729%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hMGyL86zCgiRbfNy7DfbfLpBZp%2BtS4l0onx6OIW%2Fd%2F4%3D&reserved=0> Cheers, Tomas ________________________________ From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: Thursday, November 11, 2021 10:26 AM To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Sorry, I didn't mean trace logging for all of WildFly, I was thinking about trace logging for EJBCA. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/logging#Logging-DebugLogging<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fdoc.primekey.com%2Fejbca%2Fejbca-operations%2Fejbca-ca-concept-guide%2Flogging*Logging-DebugLogging__%3BIw!!In4Qlw!8nNxnuGaxSyzwunRmKOIxMC8KZxIMaueNRWOVicq6Xa0vGl-oyFya0kknO7LGO9Rnhg%24&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C99b31a6ee64c405a7c0608d9a521b651%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637722386517939677%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=0%2B%2BJB08tVQoz8xR%2BCHSZYgDkxNb5ETwe4ksEP4NrwCg%3D&reserved=0> Thousands of CAs sounds like a quite special use case. Not a very normal use case. For sure EJBCA 7 is running in production issuing hundreds of certificates per second, from dozens of CAs, but I haven't been digging around with thousands of CAs yet personally. Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Thursday, November 11, 2021 9:59 AM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi Tomas, I have now enabled trace logging on the client side. I have seen the longest message is the following, which takes approximately 0.6 seconds. I have been unable to find a similar log message in the log of the EJBCA 6 client. TRACE [SecurityProviderSaslClientFactory] - Created SaslClient for mechanism JBOSS-LOCAL-USER, using Provider WildFlyElytron and protocol remote The above log message always occurs between the following two DEBUG log messages, which seems to be where most of the slow down is seen. 2021-11-08 14:16:52,865 DEBUG [DiscoveryEJBClientInterceptor] - DiscoveryEJBClientInterceptor: calling executeDiscovery(locator = StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None, weak affinity = None) 2021-11-08 14:16:53,298 DEBUG [DelegatingBasicLogger] - Received MODULE_AVAILABLE(8) message from node <host> for module ejbca/certstore Another log message that seems to be taking a while in the client log is the following. This takes approximately 0.3 seconds the first time it shows up, but is much faster on subsequent appearances inside the same ejbca.sh call. 2021-11-10 09:11:56,605 TRACE [AuthenticationContextConfigurationClient] - getAuthenticationConfiguration uri=http-remoting://localhost:4447, protocolDefaultPort=-1, abstractType=ejb, abstractTypeAuthority=jboss, MatchRule=[abstractType=ejb,abstractTypeAuthority=jboss,host=localhost,port=4447], AuthenticationConfiguration=[AuthenticationConfiguration:principal=anonymous,set-host=localhost,set-protocol=http-remoting,set-port=4447,providers-supplier=org.wildfly.security.provider.util.ProviderServiceLoaderSupplier@93e09b04,mechanism-properties={javax.security.sasl.policy.noanonymous=false, javax.security.sasl.policy.noplaintext=true, wildfly.sasl.local-user.quiet-auth=true}] I have been doing this upgrade testing on my system where I have 500 CAs configured. My system is only used for testing, as the production system would be at EJBCA 6 currently. I would expect there to be a few thousand CAs on the production system. Regards, Arwyn From: Tomas Gustavsson via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: 09 November 2021 08:53 To: ejb...@li...<mailto:ejb...@li...> Cc: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I’m getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fnam11.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Ce351c5fc7ff64a58a4e408d9a2db3098*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637719884629212861*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DzQOUT2OHUnYk3*2FkG33oixtRpI*2BXE6*2Bjxw5rYv32X8O4*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiolJSoqKioqKioqKioqKiUlKiUlJSUlJSUlJSUlJSUlJSUlJSUl!!In4Qlw!8-KVx3UAT0IxCIX12v4XCzVWZ8GHzkq_jDBw5LrqWPF1ZcRlbItU0ZJmT4tM4IUl8eU*24%26data%3D04*7C01*7Ctomas.gustavsson*40primekey.com*7C857053cb62f54686422308d9a4f1adc5*7Cc9ed4b459f7041&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C99b31a6ee64c405a7c0608d9a521b651%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637722386517939677%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rG1z4ECGieWdljg3Fre5E%2F9oPHaNtpLwSxuxswUCTzA%3D&reserved=0>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Launchbury, A. <Arw...@nc...> - 2021-11-11 14:44:05
|
Thanks Tomas, I currently do not believe the slow down is caused by the EJBCA or cesecore server side. I turned on trace logging for only ejbca and cesecore loggers on the server side. All of these log messages appeared within 0.75 seconds of each other for EJBCA6 and within 0.85 seconds of each other for EJBCA7. This means I don't think there has been a significant change to the server side performance of EJBCA or cesecore logic. When running a bin/ejbca.sh command I have observed the client ejbca.sh JVM startup time to be very similar in both versions of EJBCA, at around 1 second. In the case of EJBCA 6, the EJBCA and cesecore log messages show up ~ 0.5 seconds after the JVM has fully started up. In the case of EJBCA 7 the EJBCA and cesecore log messages show up ~ 1.7 seconds after the JVM has started up. This makes me think that either the client is slower by ~1.2 seconds in the new version, or there is some slow down in wildfly and the EJBRemoteInvocation. This gives the total time for one ejbca.sh command to go from ~2.25 seconds in EJBCA 6 to ~3.55, with most of this difference coming from the change in the client. (I believe changing the logging levels have had a slight effect on the performance, which is why these values are different to my original comment). Over a typical certificate renewal I would call the ejbca.sh command three separate times. The three commands I run would be bin/ejbca.sh ra setendentitystatus --username " user.name" -S 10 bin/ejbca.sh ra setpwd --username "user.name" --password "password" bin/ejbca.sh createcert --username "user.name" -password "password" -c "/tmp/tmp_csr" -f "/opt/ejbca/p12/pem/user.name.pem" As the server typically takes less than a second to respond, the change to the client performance is resulting in this process taking between 1.5 and 2 times longer than previously. I've been having some trouble running the stress test tool but I will try to get results from that to confirm the client is the issue. You mention that the stress test tool is able to run without having to restart the JVM. This leads me to thinking that it may be possible to follow the same pattern when running my certificate renewal. Is it possible to run multiple bin/ejbca.sh commands without restarting the JVM? If the JVM is reused, it may mean that the slow down in the client that I have observed would not have such a large effect over a typical workflow. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...> Sent: 11 November 2021 09:39 To: Launchbury, Arwyn <Arw...@nc...>; ejb...@li... Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Can you rule out that it is anything on the client side that is slow? For performance measurement of EJBCA itself, we typically run a "clientToolBox stress" which is a nice stress test tool that runs multiple threads in a single client JVM, avoiding any JVM loading issues, and showing certificate issuance speed. You can test single threaded performance (measure latency) and multi-threaded performance measuring throughput. This tool has been available since EJBCA 4 and can be used throughout the times. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/command-line-interfaces/ejbca-client-toolbox<https://urldefense.com/v3/__https:/doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/command-line-interfaces/ejbca-client-toolbox__;!!In4Qlw!8nNxnuGaxSyzwunRmKOIxMC8KZxIMaueNRWOVicq6Xa0vGl-oyFya0kknO7Le8vlvqY$> Cheers, Tomas ________________________________ From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: Thursday, November 11, 2021 10:26 AM To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Sorry, I didn't mean trace logging for all of WildFly, I was thinking about trace logging for EJBCA. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/logging#Logging-DebugLogging<https://urldefense.com/v3/__https:/doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/logging*Logging-DebugLogging__;Iw!!In4Qlw!8nNxnuGaxSyzwunRmKOIxMC8KZxIMaueNRWOVicq6Xa0vGl-oyFya0kknO7LGO9Rnhg$> Thousands of CAs sounds like a quite special use case. Not a very normal use case. For sure EJBCA 7 is running in production issuing hundreds of certificates per second, from dozens of CAs, but I haven't been digging around with thousands of CAs yet personally. Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Thursday, November 11, 2021 9:59 AM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi Tomas, I have now enabled trace logging on the client side. I have seen the longest message is the following, which takes approximately 0.6 seconds. I have been unable to find a similar log message in the log of the EJBCA 6 client. TRACE [SecurityProviderSaslClientFactory] - Created SaslClient for mechanism JBOSS-LOCAL-USER, using Provider WildFlyElytron and protocol remote The above log message always occurs between the following two DEBUG log messages, which seems to be where most of the slow down is seen. 2021-11-08 14:16:52,865 DEBUG [DiscoveryEJBClientInterceptor] - DiscoveryEJBClientInterceptor: calling executeDiscovery(locator = StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None, weak affinity = None) 2021-11-08 14:16:53,298 DEBUG [DelegatingBasicLogger] - Received MODULE_AVAILABLE(8) message from node <host> for module ejbca/certstore Another log message that seems to be taking a while in the client log is the following. This takes approximately 0.3 seconds the first time it shows up, but is much faster on subsequent appearances inside the same ejbca.sh call. 2021-11-10 09:11:56,605 TRACE [AuthenticationContextConfigurationClient] - getAuthenticationConfiguration uri=http-remoting://localhost:4447, protocolDefaultPort=-1, abstractType=ejb, abstractTypeAuthority=jboss, MatchRule=[abstractType=ejb,abstractTypeAuthority=jboss,host=localhost,port=4447], AuthenticationConfiguration=[AuthenticationConfiguration:principal=anonymous,set-host=localhost,set-protocol=http-remoting,set-port=4447,providers-supplier=org.wildfly.security.provider.util.ProviderServiceLoaderSupplier@93e09b04,mechanism-properties={javax.security.sasl.policy.noanonymous=false, javax.security.sasl.policy.noplaintext=true, wildfly.sasl.local-user.quiet-auth=true}] I have been doing this upgrade testing on my system where I have 500 CAs configured. My system is only used for testing, as the production system would be at EJBCA 6 currently. I would expect there to be a few thousand CAs on the production system. Regards, Arwyn From: Tomas Gustavsson via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: 09 November 2021 08:53 To: ejb...@li...<mailto:ejb...@li...> Cc: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I'm getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://urldefense.com/v3/__https:/nam11.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Ce351c5fc7ff64a58a4e408d9a2db3098*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637719884629212861*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DzQOUT2OHUnYk3*2FkG33oixtRpI*2BXE6*2Bjxw5rYv32X8O4*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiolJSoqKioqKioqKioqKiUlKiUlJSUlJSUlJSUlJSUlJSUlJSUl!!In4Qlw!8-KVx3UAT0IxCIX12v4XCzVWZ8GHzkq_jDBw5LrqWPF1ZcRlbItU0ZJmT4tM4IUl8eU*24&data=04*7C01*7Ctomas.gustavsson*40primekey.com*7C857053cb62f54686422308d9a4f1adc5*7Cc9ed4b459f7041>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Tomas G. <tom...@pr...> - 2021-11-11 14:14:50
|
Can you rule out that it is anything on the client side that is slow? For performance measurement of EJBCA itself, we typically run a "clientToolBox stress" which is a nice stress test tool that runs multiple threads in a single client JVM, avoiding any JVM loading issues, and showing certificate issuance speed. You can test single threaded performance (measure latency) and multi-threaded performance measuring throughput. This tool has been available since EJBCA 4 and can be used throughout the times. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/command-line-interfaces/ejbca-client-toolbox Cheers, Tomas ________________________________ From: Tomas Gustavsson <tom...@pr...> Sent: Thursday, November 11, 2021 10:26 AM To: Launchbury, Arwyn <Arw...@nc...>; ejb...@li... <ejb...@li...> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Sorry, I didn't mean trace logging for all of WildFly, I was thinking about trace logging for EJBCA. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/logging#Logging-DebugLogging Thousands of CAs sounds like a quite special use case. Not a very normal use case. For sure EJBCA 7 is running in production issuing hundreds of certificates per second, from dozens of CAs, but I haven't been digging around with thousands of CAs yet personally. Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...> Sent: Thursday, November 11, 2021 9:59 AM To: ejb...@li... <ejb...@li...> Cc: Tomas Gustavsson <tom...@pr...> Subject: RE: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Hi Tomas, I have now enabled trace logging on the client side. I have seen the longest message is the following, which takes approximately 0.6 seconds. I have been unable to find a similar log message in the log of the EJBCA 6 client. TRACE [SecurityProviderSaslClientFactory] - Created SaslClient for mechanism JBOSS-LOCAL-USER, using Provider WildFlyElytron and protocol remote The above log message always occurs between the following two DEBUG log messages, which seems to be where most of the slow down is seen. 2021-11-08 14:16:52,865 DEBUG [DiscoveryEJBClientInterceptor] - DiscoveryEJBClientInterceptor: calling executeDiscovery(locator = StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None, weak affinity = None) 2021-11-08 14:16:53,298 DEBUG [DelegatingBasicLogger] - Received MODULE_AVAILABLE(8) message from node <host> for module ejbca/certstore Another log message that seems to be taking a while in the client log is the following. This takes approximately 0.3 seconds the first time it shows up, but is much faster on subsequent appearances inside the same ejbca.sh call. 2021-11-10 09:11:56,605 TRACE [AuthenticationContextConfigurationClient] - getAuthenticationConfiguration uri=http-remoting://localhost:4447, protocolDefaultPort=-1, abstractType=ejb, abstractTypeAuthority=jboss, MatchRule=[abstractType=ejb,abstractTypeAuthority=jboss,host=localhost,port=4447], AuthenticationConfiguration=[AuthenticationConfiguration:principal=anonymous,set-host=localhost,set-protocol=http-remoting,set-port=4447,providers-supplier=org.wildfly.security.provider.util.ProviderServiceLoaderSupplier@93e09b04,mechanism-properties={javax.security.sasl.policy.noanonymous=false, javax.security.sasl.policy.noplaintext=true, wildfly.sasl.local-user.quiet-auth=true}] I have been doing this upgrade testing on my system where I have 500 CAs configured. My system is only used for testing, as the production system would be at EJBCA 6 currently. I would expect there to be a few thousand CAs on the production system. Regards, Arwyn From: Tomas Gustavsson via Ejbca-develop <ejb...@li...> Sent: 09 November 2021 08:53 To: ejb...@li... Cc: Tomas Gustavsson <tom...@pr...> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I’m getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fnam11.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU*24%26data%3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Ce351c5fc7ff64a58a4e408d9a2db3098*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637719884629212861*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000%26sdata%3DzQOUT2OHUnYk3*2FkG33oixtRpI*2BXE6*2Bjxw5rYv32X8O4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiolJSoqKioqKioqKioqKiUlKiUlJSUlJSUlJSUlJSUlJSUlJSUl!!In4Qlw!8-KVx3UAT0IxCIX12v4XCzVWZ8GHzkq_jDBw5LrqWPF1ZcRlbItU0ZJmT4tM4IUl8eU%24&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C857053cb62f54686422308d9a4f1adc5%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637722180244179227%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gZbFlmvoNtRWc0re2vYlOxWvJm%2Bn65fZH%2FXnBbWfVq4%3D&reserved=0>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Tomas G. <tom...@pr...> - 2021-11-11 10:59:52
|
Sorry, I didn't mean trace logging for all of WildFly, I was thinking about trace logging for EJBCA. https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/logging#Logging-DebugLogging Thousands of CAs sounds like a quite special use case. Not a very normal use case. For sure EJBCA 7 is running in production issuing hundreds of certificates per second, from dozens of CAs, but I haven't been digging around with thousands of CAs yet personally. Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...> Sent: Thursday, November 11, 2021 9:59 AM To: ejb...@li... <ejb...@li...> Cc: Tomas Gustavsson <tom...@pr...> Subject: RE: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Hi Tomas, I have now enabled trace logging on the client side. I have seen the longest message is the following, which takes approximately 0.6 seconds. I have been unable to find a similar log message in the log of the EJBCA 6 client. TRACE [SecurityProviderSaslClientFactory] - Created SaslClient for mechanism JBOSS-LOCAL-USER, using Provider WildFlyElytron and protocol remote The above log message always occurs between the following two DEBUG log messages, which seems to be where most of the slow down is seen. 2021-11-08 14:16:52,865 DEBUG [DiscoveryEJBClientInterceptor] - DiscoveryEJBClientInterceptor: calling executeDiscovery(locator = StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None, weak affinity = None) 2021-11-08 14:16:53,298 DEBUG [DelegatingBasicLogger] - Received MODULE_AVAILABLE(8) message from node <host> for module ejbca/certstore Another log message that seems to be taking a while in the client log is the following. This takes approximately 0.3 seconds the first time it shows up, but is much faster on subsequent appearances inside the same ejbca.sh call. 2021-11-10 09:11:56,605 TRACE [AuthenticationContextConfigurationClient] - getAuthenticationConfiguration uri=http-remoting://localhost:4447, protocolDefaultPort=-1, abstractType=ejb, abstractTypeAuthority=jboss, MatchRule=[abstractType=ejb,abstractTypeAuthority=jboss,host=localhost,port=4447], AuthenticationConfiguration=[AuthenticationConfiguration:principal=anonymous,set-host=localhost,set-protocol=http-remoting,set-port=4447,providers-supplier=org.wildfly.security.provider.util.ProviderServiceLoaderSupplier@93e09b04,mechanism-properties={javax.security.sasl.policy.noanonymous=false, javax.security.sasl.policy.noplaintext=true, wildfly.sasl.local-user.quiet-auth=true}] I have been doing this upgrade testing on my system where I have 500 CAs configured. My system is only used for testing, as the production system would be at EJBCA 6 currently. I would expect there to be a few thousand CAs on the production system. Regards, Arwyn From: Tomas Gustavsson via Ejbca-develop <ejb...@li...> Sent: 09 November 2021 08:53 To: ejb...@li... Cc: Tomas Gustavsson <tom...@pr...> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I’m getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fnam11.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU*24%26data%3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Ce351c5fc7ff64a58a4e408d9a2db3098*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637719884629212861*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000%26sdata%3DzQOUT2OHUnYk3*2FkG33oixtRpI*2BXE6*2Bjxw5rYv32X8O4*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiolJSoqKioqKioqKioqKiUlKiUlJSUlJSUlJSUlJSUlJSUlJSUl!!In4Qlw!8-KVx3UAT0IxCIX12v4XCzVWZ8GHzkq_jDBw5LrqWPF1ZcRlbItU0ZJmT4tM4IUl8eU%24&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C857053cb62f54686422308d9a4f1adc5%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637722180244179227%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gZbFlmvoNtRWc0re2vYlOxWvJm%2Bn65fZH%2FXnBbWfVq4%3D&reserved=0>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Launchbury, A. <Arw...@nc...> - 2021-11-11 09:00:15
|
Hi Tomas, I have now enabled trace logging on the client side. I have seen the longest message is the following, which takes approximately 0.6 seconds. I have been unable to find a similar log message in the log of the EJBCA 6 client. TRACE [SecurityProviderSaslClientFactory] - Created SaslClient for mechanism JBOSS-LOCAL-USER, using Provider WildFlyElytron and protocol remote The above log message always occurs between the following two DEBUG log messages, which seems to be where most of the slow down is seen. 2021-11-08 14:16:52,865 DEBUG [DiscoveryEJBClientInterceptor] - DiscoveryEJBClientInterceptor: calling executeDiscovery(locator = StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None, weak affinity = None) 2021-11-08 14:16:53,298 DEBUG [DelegatingBasicLogger] - Received MODULE_AVAILABLE(8) message from node <host> for module ejbca/certstore Another log message that seems to be taking a while in the client log is the following. This takes approximately 0.3 seconds the first time it shows up, but is much faster on subsequent appearances inside the same ejbca.sh call. 2021-11-10 09:11:56,605 TRACE [AuthenticationContextConfigurationClient] - getAuthenticationConfiguration uri=http-remoting://localhost:4447, protocolDefaultPort=-1, abstractType=ejb, abstractTypeAuthority=jboss, MatchRule=[abstractType=ejb,abstractTypeAuthority=jboss,host=localhost,port=4447], AuthenticationConfiguration=[AuthenticationConfiguration:principal=anonymous,set-host=localhost,set-protocol=http-remoting,set-port=4447,providers-supplier=org.wildfly.security.provider.util.ProviderServiceLoaderSupplier@93e09b04,mechanism-properties={javax.security.sasl.policy.noanonymous=false, javax.security.sasl.policy.noplaintext=true, wildfly.sasl.local-user.quiet-auth=true}] I have been doing this upgrade testing on my system where I have 500 CAs configured. My system is only used for testing, as the production system would be at EJBCA 6 currently. I would expect there to be a few thousand CAs on the production system. Regards, Arwyn From: Tomas Gustavsson via Ejbca-develop <ejb...@li...> Sent: 09 November 2021 08:53 To: ejb...@li... Cc: Tomas Gustavsson <tom...@pr...> Subject: Re: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>>; ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I'm getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://urldefense.com/v3/__https:/nam11.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000*26sdata*3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU*24&data=04*7C01*7Ctomas.gustavsson*40primekey.com*7Ce351c5fc7ff64a58a4e408d9a2db3098*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637719884629212861*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=zQOUT2OHUnYk3*2FkG33oixtRpI*2BXE6*2Bjxw5rYv32X8O4*3D&reserved=0__;JSUlJSUlJSUlJSoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiolJSoqKioqKioqKioqKiUlKiUlJSUlJSUlJSUlJSUlJSUlJSUl!!In4Qlw!8-KVx3UAT0IxCIX12v4XCzVWZ8GHzkq_jDBw5LrqWPF1ZcRlbItU0ZJmT4tM4IUl8eU$>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Tomas G. <tom...@pr...> - 2021-11-09 11:28:03
|
Have you enabled debug logging? That should show clearly if there is anything in EJBCA that takes time. Question: do you have 500 CAs configured? Is this a production use case? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...> Sent: Monday, November 8, 2021 6:14 PM To: Tomas Gustavsson <tom...@pr...>; ejb...@li... <ejb...@li...> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I’m getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fnam11.safelinks.protection.outlook.com%2F%3Furl%3Dhttps*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24%26data%3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000%26sdata%3DBEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D%26reserved%3D0__%3BJSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU%24&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7Ce351c5fc7ff64a58a4e408d9a2db3098%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637719884629212861%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zQOUT2OHUnYk3%2FkG33oixtRpI%2BXE6%2Bjxw5rYv32X8O4%3D&reserved=0>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Launchbury, A. <Arw...@nc...> - 2021-11-08 17:14:13
|
Thanks Tomas, I think my previous message regarding the client may have been incorrect. In the EJBCA 7 case I'm getting a io.undertow.request log in the server log approximately 1s after calling ejbca.sh, which is when I think the client JVM has started up. However there is then an approximately 1 second gap before the first cesecore log shows up (org.cesecore.configuration.GlobalConfigurationSessionBean). During this time the server does not seem to be doing anything, but the client is. In the EJBCA 6 case the first server log appears approximately 1 second after the ejbca.sh command is called, but it then takes only ~0.3 seconds for the cesecore log to show up. So it looks like the client is now taking ~2 seconds to connect after the upgrade, vs the old client taking ~1.2 seconds. You mention a slow client has been observed before, is there a way of finding out the cause and finding a way to speed up the client startup? I have now checked all of the DB indexes in the doc/sql-scripts/create-index-ejbca.sql script. After putting all indexes in place it does not seem to have had an effect on the total time. I have tested this and observed the slow down for up to about 500 CAs. Regards, Arwyn From: Tomas Gustavsson <tom...@pr...> Sent: 05 November 2021 18:21 To: Launchbury, Arwyn <Arw...@nc...> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 Sounds like you are missing a database index. Check the recommended database indexes. Do you have many CAs, and/or CA certificates? Cheers, Tomas ________________________________ From: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Sent: Friday, November 5, 2021 7:14 PM To: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Subject: RE: Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...<mailto:tom...@pr...>> Sent: 05 November 2021 08:25 To: ejb...@li...<mailto:ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://urldefense.com/v3/__https:/nam11.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2Fnam11.safelinks.protection.outlook.com*2F*3Furl*3Dhttps*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning*26data*3D04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*26sdata*3DeKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D*26reserved*3D0__*3BJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI*24&data=04*7C01*7Ctomas.gustavsson*40primekey.com*7Cd1ea972107fb4d26293a08d9a0882a3e*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637717328989428655*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C1000&sdata=BEAkcfNI7HxZ5iFmsFpWTfvJRTVqjZAtgUL1TF2nlvI*3D&reserved=0__;JSUlJSUlJSUlJSoqKioqKioqKiUlKioqKioqKioqKioqJSUqKioqJSUlJSUlJSUlJSUlJSUlJSU!!In4Qlw!_2cNsYkEMpPutSXEorm2ptooFtWhc5Jm_SZI6aA_0-guiyQ8dkI9smRCjrBx1rbvaWU$>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Launchbury, A. <Arw...@nc...> - 2021-11-05 19:25:38
|
Thank you for the response. Currently we believe the issue is server side. I have compared the time between the ejbca.sh cli command being called and messages appearing in the server.log. This time was the same for both EJBCA 6 and EJBCA 7. I have tried profiling the older version of EJBCA 6 to compare it to the results we found for EJBCA 7. The getCAInternal function was taking approximately 0.05 seconds on the old version, approximately 10 times quicker than in EJBCA 7. I could not find getCertificateProfile when running EJBCA 6. These are the only functions from the ejbca or cesecore packages that seemed to be taking a long time in EJBCA 7, and as there is such a large difference in these functions after the upgrade we think this could be the cause of the issues. Has there been any changes to the internal EJBCA caching from the upgrade? Is there any specific options that mean EJBCA does not cache certificates anymore? Regards, Arwyn From: Tomas Gustavsson <tom...@pr...> Sent: 05 November 2021 08:25 To: ejb...@li... Cc: Launchbury, Arwyn <Arw...@nc...> Subject: Re: Decreased Performance after upgrade to EJBCA Version 7 *External Message* - Use caution before opening links or attachments If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...<mailto:ejb...@li...>> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li...<mailto:ejb...@li...> <ejb...@li...<mailto:ejb...@li...>> Cc: Launchbury, Arwyn <Arw...@nc...<mailto:Arw...@nc...>> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke...<mailto:In...@ke...> with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://urldefense.com/v3/__https:/nam11.safelinks.protection.outlook.com/?url=https*3A*2F*2Fdoc.primekey.com*2Fejbca743*2Fejbca-installation*2Fapplication-servers*2Fwildfly-18-jboss-eap-7-3*23WildFly18*2FJBossEAP7.3-PerformanceTuning&data=04*7C01*7Ctomas.gustavsson*40primekey.com*7Cb5562e5e7ab14034f90808d99fba0f08*7Cc9ed4b459f70418aaa58f04c80848ca9*7C0*7C0*7C637716444467209936*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000&sdata=eKHxGCeaet56ecbgaoxt6WzH4*2F*2FLzB9Zw7T*2Ft5eYBEQ*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!In4Qlw!6ZvD7OSOz-ZOVXXibdUGr8TXgIluCtaXVSPBS0iknh_KKTh-trtTeYreMBdyiA9e9GI$>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Tomas G. <tom...@pr...> - 2021-11-05 14:57:12
|
If anything, the performance of EJBCA should be better not worse after an upgrade. Did you check recommended indexes to add new database indexes that should be there. There are some new ones that we recommend. See doc/sql-scripts for the recommended indexes. As you already checked slow queries though, it may or may not help anything. If it just startup of the cli command that takes time, or does every request take time if you for example run a stress test? I.e. identify if its the client or server that has slowdown. You can check the server.log to see when a request come in and how long it takes to process. We have seen cases where for various reasons the startup/init time of java on the client side takes time, i.e. not EJBCA that is slow but the start-up of the JVM for the CLI client side process. Regards, Tomas ________________________________ From: Launchbury, Arwyn via Ejbca-develop <ejb...@li...> Sent: Thursday, November 4, 2021 6:17 PM To: ejb...@li... <ejb...@li...> Cc: Launchbury, Arwyn <Arw...@nc...> Subject: [Ejbca-develop] Decreased Performance after upgrade to EJBCA Version 7 CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdoc.primekey.com%2Fejbca743%2Fejbca-installation%2Fapplication-servers%2Fwildfly-18-jboss-eap-7-3%23WildFly18%2FJBossEAP7.3-PerformanceTuning&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7Cb5562e5e7ab14034f90808d99fba0f08%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637716444467209936%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=eKHxGCeaet56ecbgaoxt6WzH4%2F%2FLzB9Zw7T%2Ft5eYBEQ%3D&reserved=0>) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Launchbury, A. <Arw...@nc...> - 2021-11-04 17:39:09
|
Hi, We are currently in the process of upgrading the version of EJBCA we use and have noticed a significant decrease in performance. Our previous installation used EJBCA version 6.3.1.1, jboss version 7.1.1, and opendk 7. We have tried to upgrade to EJBCA version 7.4.3.2, wildfly version 18.0.1, and openjdk 8. We have noticed that ejbca.sh commands take approximately twice as long after the upgrade, for example ./ejbca.sh ra setendentitystatus went from ~1.5 seconds before the upgrade to ~3 seconds after the upgrade, and .ejbca.sh createcert went from ~2 seconds to ~4 seconds. We have tried some of the options in the PerformanceTuning (https://doc.primekey.com/ejbca743/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-PerformanceTuning) section of the documentation, which has had no significant effect on the performance. We have tried profiling the EJBCA process, but have not yet found anything that is obviously causing the performance issues. Currently we have seen that both Lorg/cesecore/certificates/certificateprofile/CertificateProfileSessionBean:::getCertificateProfile and Lorg/cesecore/certificates/ca/CaSessionBean:::getCAInternal take approximately 0.5 seconds each during a setendentitystatus run. These seem to be taking a long time but we're not sure if they are the actual cause of the performance issues. We currently don't believe the MySQL DB is the cause of the performance issues as there were no entries in the Slow Query Log for any time greater than 50ms. Does anyone have any suggestions on how we could improve the performance of our installation, or how we would find the source of the performance issues? Kind Regards, Arwyn |
From: Tomas G. <tom...@pr...> - 2021-08-27 12:44:14
|
Then it makes sense. So not enforce client certificate authentication in a standard EJBCA software installation, use port 8442. 8080 - plain text 8442 - TLS with server authentication only 8443 - TLS with mutual authentication Cheers, Tomas ________________________________ From: Jeremy Hansen <je...@sk...> Sent: Friday, August 27, 2021 10:32 AM To: ejb...@li... <ejb...@li...> Cc: Tomas Gustavsson <tom...@pr...> Subject: Re: [Ejbca-develop] Not able to access RA web without certficate CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. |
From: Jeremy H. <je...@sk...> - 2021-08-27 08:33:14
|
No, I’m using 8443 ssl. Thanks -jeremy > On Friday, Aug 27, 2021 at 1:26 AM, Tomas Gustavsson via Ejbca-develop <ejb...@li... (mailto:ejb...@li...)> wrote: > Are you accessing it on port 8442 then, and not 8443? > > Cheers, > Tomas > > From: Jeremy Hansen <je...@sk...> > Sent: Wednesday, August 25, 2021 11:31 PM > To: ejb...@li... <ejb...@li...> > Subject: [Ejbca-develop] Not able to access RA web without certficate > > > CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. > > I followed the docs here: > > https://download.primekey.se/docs/EJBCA-Enterprise/6_15_0/Configure_an_RA_for_Public_Access.html (https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdownload.primekey.se%2Fdocs%2FEJBCA-Enterprise%2F6_15_0%2FConfigure_an_RA_for_Public_Access.html&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C9b7e0ef4b60a477e1b4208d9681200d4%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637655249565968265%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9ySGza%2B5qACpQ9t7F73jepigAQ%2FIQdoPhvdV7Y%2BR%2FzU%3D&reserved=0) > > Screenshots attached. > > But I’m still unable to access /ejbca/ra without a certificate. > > Thanks! > -jeremy > > > > > _______________________________________________ > Ejbca-develop mailing list > Ejb...@li... > https://lists.sourceforge.net/lists/listinfo/ejbca-develop |
From: Tomas G. <tom...@pr...> - 2021-08-27 08:26:05
|
Are you accessing it on port 8442 then, and not 8443? Cheers, Tomas ________________________________ From: Jeremy Hansen <je...@sk...> Sent: Wednesday, August 25, 2021 11:31 PM To: ejb...@li... <ejb...@li...> Subject: [Ejbca-develop] Not able to access RA web without certficate CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. I followed the docs here: https://download.primekey.se/docs/EJBCA-Enterprise/6_15_0/Configure_an_RA_for_Public_Access.html<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdownload.primekey.se%2Fdocs%2FEJBCA-Enterprise%2F6_15_0%2FConfigure_an_RA_for_Public_Access.html&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C9b7e0ef4b60a477e1b4208d9681200d4%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637655249565968265%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9ySGza%2B5qACpQ9t7F73jepigAQ%2FIQdoPhvdV7Y%2BR%2FzU%3D&reserved=0> Screenshots attached. But I’m still unable to access /ejbca/ra without a certificate. Thanks! -jeremy |
From: Jeremy H. <je...@sk...> - 2021-08-25 21:47:31
|
I followed the docs here: https://download.primekey.se/docs/EJBCA-Enterprise/6_15_0/Configure_an_RA_for_Public_Access.html Screenshots attached. But I’m still unable to access /ejbca/ra without a certificate. Thanks! -jeremy |
From: Tomas G. <tom...@pr...> - 2021-08-09 05:50:59
|
Hi, Mapping a signature algorithm from something custom into a standard algorithm requires source code changes so that is not something you can do easily. Not using standard naming, for standard things is one such thing that is likely to cause you unnecessary problems and costs continuously down the road for years. For standard things such as custom certificate extensions you can use as many custom OIDs and structures as you like, easy configured and without affecting any interoperability. Cheers, Tomas ________________________________ From: sinuthampi <san...@gm...> Sent: Thursday, August 5, 2021 8:57 PM To: ejb...@li... <ejb...@li...> Subject: [Ejbca-develop] Fwd: custom oids. CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. is it possible to use custom OIDs for signing algorithms in EJBCA? , i have uploaded a sample certificate which is using a custom private oid and this oid is mapped with ed25519ph. how is this possible using EJBCA, is there any other ca which is supporting this custom method? example 1.3.6.1.4.1.33.3.6.33.5.33 >> map with ed25519ph [image.png] |
From: sinuthampi <san...@gm...> - 2021-08-05 18:57:35
|
is it possible to use custom OIDs for signing algorithms in EJBCA? , i have uploaded a sample certificate which is using a custom private oid and this oid is mapped with ed25519ph. how is this possible using EJBCA, is there any other ca which is supporting this custom method? example 1.3.6.1.4.1.33.3.6.33.5.33 >> map with ed25519ph [image: image.png] |
From: Tomas G. <tom...@pr...> - 2021-07-28 12:45:04
|
The EJBCA Community repository on GitHub has been updated with the latest changes. https://github.com/primekeydevs/ejbca-ce [https://opengraph.githubassets.com/273d856dcd508b681be98c6bf3c92bb275c340e315678771e206165d1420b001/primekeydevs/ejbca-ce]<https://github.com/primekeydevs/ejbca-ce> GitHub - primekeydevs/ejbca-ce: EJBCA - Open Source Enterprise PKI<https://github.com/primekeydevs/ejbca-ce> EJBCA - Open Source Enterprise PKI. Contribute to primekeydevs/ejbca-ce development by creating an account on GitHub. github.com Regards, The EJBCA Team |
From: Tomas G. <tom...@pr...> - 2021-07-26 08:57:10
|
Hi, Did you figure this out? probably screenshots are better than the XML dump of the profile. Takes more effort to load and check. TLS authentication for IMAPS should require the same certificate profile settings (clone the SERVER profile) as for regular TLS. Cheers, Tomas ________________________________ From: Jeremy Hansen <je...@sk...> Sent: Sunday, July 11, 2021 7:58 AM To: Ejb...@li... <Ejb...@li...> Subject: [Ejbca-develop] p12 certificates CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. I’m trying to work through the process of generating client certificates, primarily for postfix/dovecot authentication. Piecing things together from docs and YouTube (probably a mistake), I’ve created an end entity: cat entityprofile_UserCertEntity-1718497906.xml <?xml version="1.0" encoding="UTF-8"?> <java version="1.8.0_292" class="java.beans.XMLDecoder"> <object class="java.util.LinkedHashMap"> <void method="put"> <string>version</string> <float>15.0</float> </void> <void method="put"> <string>NUMBERARRAY</string> <object class="java.util.ArrayList"> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> </object> </void> <void method="put"> <string>SUBJECTDNFIELDORDER</string> <object class="java.util.ArrayList"> <void method="add"> <int>500</int> </void> <void method="add"> <int>1200</int> </void> <void method="add"> <int>1600</int> </void> </object> </void> <void method="put"> <string>SUBJECTALTNAMEFIELDORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <string>SUBJECTDIRATTRFIELDORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <string>SSH_FIELD_ORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <int>0</int> <string></string> </void> <void method="put"> <int>20000</int> <boolean>true</boolean> </void> <void method="put"> <int>10000</int> <boolean>true</boolean> </void> <void method="put"> <int>30000</int> <boolean>true</boolean> </void> <void method="put"> <int>50000</int> <boolean>false</boolean> </void> <void method="put"> <int>1</int> <string></string> </void> <void method="put"> <int>20001</int> <boolean>true</boolean> </void> <void method="put"> <int>10001</int> <boolean>true</boolean> </void> <void method="put"> <int>30001</int> <boolean>true</boolean> </void> <void method="put"> <int>50001</int> <boolean>false</boolean> </void> <void method="put"> <int>95</int> <string></string> </void> <void method="put"> <int>20095</int> <boolean>false</boolean> </void> <void method="put"> <int>10095</int> <boolean>true</boolean> </void> <void method="put"> <int>30095</int> <boolean>true</boolean> </void> <void method="put"> <int>50095</int> <boolean>false</boolean> </void> <void method="put"> <int>96</int> <string>8</string> </void> <void method="put"> <int>20096</int> <boolean>false</boolean> </void> <void method="put"> <int>10096</int> <boolean>true</boolean> </void> <void method="put"> <int>30096</int> <boolean>true</boolean> </void> <void method="put"> <int>50096</int> <boolean>false</boolean> </void> <void method="put"> <int>5</int> <string></string> </void> <void method="put"> <int>20005</int> <boolean>true</boolean> </void> <void method="put"> <int>10005</int> <boolean>true</boolean> </void> <void method="put"> <int>30005</int> <boolean>true</boolean> </void> <void method="put"> <int>50005</int> <boolean>false</boolean> </void> <void method="put"> <int>26</int> <string></string> </void> <void method="put"> <int>20026</int> <boolean>false</boolean> </void> <void method="put"> <int>10026</int> <boolean>true</boolean> </void> <void method="put"> <int>30026</int> <boolean>true</boolean> </void> <void method="put"> <int>50026</int> <boolean>false</boolean> </void> <void method="put"> <int>29</int> <string>2504481</string> </void> <void method="put"> <int>20029</int> <boolean>true</boolean> </void> <void method="put"> <int>10029</int> <boolean>true</boolean> </void> <void method="put"> <int>30029</int> <boolean>true</boolean> </void> <void method="put"> <int>50029</int> <boolean>false</boolean> </void> <void method="put"> <int>30</int> <string>2504481</string> </void> <void method="put"> <int>20030</int> <boolean>true</boolean> </void> <void method="put"> <int>10030</int> <boolean>true</boolean> </void> <void method="put"> <int>30030</int> <boolean>true</boolean> </void> <void method="put"> <int>50030</int> <boolean>false</boolean> </void> <void method="put"> <int>31</int> <string>2</string> </void> <void method="put"> <int>20031</int> <boolean>true</boolean> </void> <void method="put"> <int>10031</int> <boolean>true</boolean> </void> <void method="put"> <int>30031</int> <boolean>true</boolean> </void> <void method="put"> <int>50031</int> <boolean>false</boolean> </void> <void method="put"> <int>32</int> <string>1;2;3;4</string> </void> <void method="put"> <int>20032</int> <boolean>true</boolean> </void> <void method="put"> <int>10032</int> <boolean>true</boolean> </void> <void method="put"> <int>30032</int> <boolean>true</boolean> </void> <void method="put"> <int>50032</int> <boolean>false</boolean> </void> <void method="put"> <int>33</int> <string></string> </void> <void method="put"> <int>20033</int> <boolean>false</boolean> </void> <void method="put"> <int>10033</int> <boolean>true</boolean> </void> <void method="put"> <int>30033</int> <boolean>true</boolean> </void> <void method="put"> <int>50033</int> <boolean>false</boolean> </void> <void method="put"> <int>34</int> <string></string> </void> <void method="put"> <int>20034</int> <boolean>true</boolean> </void> <void method="put"> <int>10034</int> <boolean>false</boolean> </void> <void method="put"> <int>30034</int> <boolean>true</boolean> </void> <void method="put"> <int>50034</int> <boolean>false</boolean> </void> <void method="put"> <int>38</int> <string>-1683721591</string> </void> <void method="put"> <int>20038</int> <boolean>true</boolean> </void> <void method="put"> <int>10038</int> <boolean>true</boolean> </void> <void method="put"> <int>30038</int> <boolean>true</boolean> </void> <void method="put"> <int>50038</int> <boolean>false</boolean> </void> <void method="put"> <int>37</int> <string>-1683721591</string> </void> <void method="put"> <int>20037</int> <boolean>true</boolean> </void> <void method="put"> <int>10037</int> <boolean>true</boolean> </void> <void method="put"> <int>30037</int> <boolean>true</boolean> </void> <void method="put"> <int>50037</int> <boolean>false</boolean> </void> <void method="put"> <int>98</int> <string></string> </void> <void method="put"> <int>20098</int> <boolean>false</boolean> </void> <void method="put"> <int>10098</int> <boolean>false</boolean> </void> <void method="put"> <int>30098</int> <boolean>true</boolean> </void> <void method="put"> <int>50098</int> <boolean>false</boolean> </void> <void method="put"> <int>99</int> <string></string> </void> <void method="put"> <int>20099</int> <boolean>false</boolean> </void> <void method="put"> <int>10099</int> <boolean>false</boolean> </void> <void method="put"> <int>30099</int> <boolean>true</boolean> </void> <void method="put"> <int>50099</int> <boolean>false</boolean> </void> <void method="put"> <int>97</int> <string></string> </void> <void method="put"> <int>20097</int> <boolean>false</boolean> </void> <void method="put"> <int>10097</int> <boolean>false</boolean> </void> <void method="put"> <int>30097</int> <boolean>true</boolean> </void> <void method="put"> <int>50097</int> <boolean>false</boolean> </void> <void method="put"> <int>91</int> <string></string> </void> <void method="put"> <int>20091</int> <boolean>false</boolean> </void> <void method="put"> <int>10091</int> <boolean>false</boolean> </void> <void method="put"> <int>30091</int> <boolean>true</boolean> </void> <void method="put"> <int>50091</int> <boolean>false</boolean> </void> <void method="put"> <int>94</int> <string>-1</string> </void> <void method="put"> <int>20094</int> <boolean>false</boolean> </void> <void method="put"> <int>10094</int> <boolean>false</boolean> </void> <void method="put"> <int>30094</int> <boolean>true</boolean> </void> <void method="put"> <int>50094</int> <boolean>false</boolean> </void> <void method="put"> <int>93</int> <string>-1</string> </void> <void method="put"> <int>20093</int> <boolean>false</boolean> </void> <void method="put"> <int>10093</int> <boolean>false</boolean> </void> <void method="put"> <int>30093</int> <boolean>true</boolean> </void> <void method="put"> <int>50093</int> <boolean>false</boolean> </void> <void method="put"> <int>89</int> <string></string> </void> <void method="put"> <int>20089</int> <boolean>false</boolean> </void> <void method="put"> <int>10089</int> <boolean>false</boolean> </void> <void method="put"> <int>30089</int> <boolean>true</boolean> </void> <void method="put"> <int>50089</int> <boolean>false</boolean> </void> <void method="put"> <int>88</int> <string></string> </void> <void method="put"> <int>20088</int> <boolean>false</boolean> </void> <void method="put"> <int>10088</int> <boolean>false</boolean> </void> <void method="put"> <int>30088</int> <boolean>true</boolean> </void> <void method="put"> <int>50088</int> <boolean>false</boolean> </void> <void method="put"> <int>87</int> <string></string> </void> <void method="put"> <int>20087</int> <boolean>false</boolean> </void> <void method="put"> <int>10087</int> <boolean>false</boolean> </void> <void method="put"> <int>30087</int> <boolean>true</boolean> </void> <void method="put"> <int>50087</int> <boolean>false</boolean> </void> <void method="put"> <int>12</int> <string></string> </void> <void method="put"> <int>20012</int> <boolean>true</boolean> </void> <void method="put"> <int>10012</int> <boolean>true</boolean> </void> <void method="put"> <int>30012</int> <boolean>true</boolean> </void> <void method="put"> <int>50012</int> <boolean>false</boolean> </void> <void method="put"> <int>16</int> <string>United States</string> </void> <void method="put"> <int>20016</int> <boolean>true</boolean> </void> <void method="put"> <int>10016</int> <boolean>true</boolean> </void> <void method="put"> <int>30016</int> <boolean>true</boolean> </void> <void method="put"> <int>50016</int> <boolean>false</boolean> </void> <void method="put"> <int>10090</int> <boolean>true</boolean> </void> <void method="put"> <int>90</int> <string>0</string> </void> <void method="put"> <int>10002</int> <boolean>false</boolean> </void> <void method="put"> <int>2</int> <string>false</string> </void> <void method="put"> <int>20002</int> <boolean>false</boolean> </void> <void method="put"> <int>60</int> <string></string> </void> <void method="put"> <string>REVERSEFFIELDCHECKS</string> <boolean>false</boolean> </void> <void method="put"> <string>ALLOW_MERGEDN_WEBSERVICES</string> <boolean>true</boolean> </void> <void method="put"> <string>ALLOW_MULTI_VALUE_RDNS</string> <boolean>false</boolean> </void> <void method="put"> <int>201</int> <string></string> </void> <void method="put"> <int>20201</int> <boolean>false</boolean> </void> <void method="put"> <int>30201</int> <boolean>false</boolean> </void> <void method="put"> <int>202</int> <string></string> </void> <void method="put"> <int>20202</int> <boolean>false</boolean> </void> <void method="put"> <int>30202</int> <boolean>false</boolean> </void> <void method="put"> <int>10092</int> <boolean>false</boolean> </void> <void method="put"> <string>USEEXTENSIONDATA</string> <boolean>false</boolean> </void> <void method="put"> <string>PSD2QCSTATEMENT</string> <boolean>false</boolean> </void> <void method="put"> <int>10035</int> <boolean>false</boolean> </void> <void method="put"> <string>PRINTINGUSE</string> <boolean>false</boolean> </void> <void method="put"> <string>USERNOTIFICATIONS</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <int>10028</int> <boolean>false</boolean> </void> <void method="put"> <int>20028</int> <boolean>false</boolean> </void> <void method="put"> <int>28</int> <string>false</string> </void> <void method="put"> <int>20035</int> <boolean>false</boolean> </void> <void method="put"> <int>35</int> <string>false</string> </void> <void method="put"> <string>PRINTINGREQUIRED</string> <boolean>false</boolean> </void> <void method="put"> <string>PRINTINGDEFAULT</string> <boolean>false</boolean> </void> </object> </java> [ejbca@ca tmp]$ and I added an entry: ejbca@ca ejbca]$ ./bin/ejbca.sh ra listnewendentities New end entity: jeremy, "CN=Jeremy Hansen,O=CLX,C=US", "", je...@cl...rp, 10, 1, 2 [ejbca@ca ejbca]$ But when I do the batch processing, I see no error, but there’s no p12 file: ejbca@ca ejbca]$ ./bin/ejbca.sh batch jeremy Generating keys in directory /opt/ejbca-ce-main/p12. ejbca@ca ejbca]$ ls p12/ superadmin.p12 tomcat.jks truststore.jks [ejbca@ca ejbca]$ So I’m trying to figure out what I’m doing wrong. The end goal is to use client certificates to authenticate mail in the same way that Ejbca asked for the p12 cert for the SuperAdmin for authentication. |
From: Jeremy H. <je...@sk...> - 2021-07-11 05:59:00
|
I’m trying to work through the process of generating client certificates, primarily for postfix/dovecot authentication. Piecing things together from docs and YouTube (probably a mistake), I’ve created an end entity: cat entityprofile_UserCertEntity-1718497906.xml <?xml version="1.0" encoding="UTF-8"?> <java version="1.8.0_292" class="java.beans.XMLDecoder"> <object class="java.util.LinkedHashMap"> <void method="put"> <string>version</string> <float>15.0</float> </void> <void method="put"> <string>NUMBERARRAY</string> <object class="java.util.ArrayList"> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>0</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> <void method="add"> <int>1</int> </void> </object> </void> <void method="put"> <string>SUBJECTDNFIELDORDER</string> <object class="java.util.ArrayList"> <void method="add"> <int>500</int> </void> <void method="add"> <int>1200</int> </void> <void method="add"> <int>1600</int> </void> </object> </void> <void method="put"> <string>SUBJECTALTNAMEFIELDORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <string>SUBJECTDIRATTRFIELDORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <string>SSH_FIELD_ORDER</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <int>0</int> <string></string> </void> <void method="put"> <int>20000</int> <boolean>true</boolean> </void> <void method="put"> <int>10000</int> <boolean>true</boolean> </void> <void method="put"> <int>30000</int> <boolean>true</boolean> </void> <void method="put"> <int>50000</int> <boolean>false</boolean> </void> <void method="put"> <int>1</int> <string></string> </void> <void method="put"> <int>20001</int> <boolean>true</boolean> </void> <void method="put"> <int>10001</int> <boolean>true</boolean> </void> <void method="put"> <int>30001</int> <boolean>true</boolean> </void> <void method="put"> <int>50001</int> <boolean>false</boolean> </void> <void method="put"> <int>95</int> <string></string> </void> <void method="put"> <int>20095</int> <boolean>false</boolean> </void> <void method="put"> <int>10095</int> <boolean>true</boolean> </void> <void method="put"> <int>30095</int> <boolean>true</boolean> </void> <void method="put"> <int>50095</int> <boolean>false</boolean> </void> <void method="put"> <int>96</int> <string>8</string> </void> <void method="put"> <int>20096</int> <boolean>false</boolean> </void> <void method="put"> <int>10096</int> <boolean>true</boolean> </void> <void method="put"> <int>30096</int> <boolean>true</boolean> </void> <void method="put"> <int>50096</int> <boolean>false</boolean> </void> <void method="put"> <int>5</int> <string></string> </void> <void method="put"> <int>20005</int> <boolean>true</boolean> </void> <void method="put"> <int>10005</int> <boolean>true</boolean> </void> <void method="put"> <int>30005</int> <boolean>true</boolean> </void> <void method="put"> <int>50005</int> <boolean>false</boolean> </void> <void method="put"> <int>26</int> <string></string> </void> <void method="put"> <int>20026</int> <boolean>false</boolean> </void> <void method="put"> <int>10026</int> <boolean>true</boolean> </void> <void method="put"> <int>30026</int> <boolean>true</boolean> </void> <void method="put"> <int>50026</int> <boolean>false</boolean> </void> <void method="put"> <int>29</int> <string>2504481</string> </void> <void method="put"> <int>20029</int> <boolean>true</boolean> </void> <void method="put"> <int>10029</int> <boolean>true</boolean> </void> <void method="put"> <int>30029</int> <boolean>true</boolean> </void> <void method="put"> <int>50029</int> <boolean>false</boolean> </void> <void method="put"> <int>30</int> <string>2504481</string> </void> <void method="put"> <int>20030</int> <boolean>true</boolean> </void> <void method="put"> <int>10030</int> <boolean>true</boolean> </void> <void method="put"> <int>30030</int> <boolean>true</boolean> </void> <void method="put"> <int>50030</int> <boolean>false</boolean> </void> <void method="put"> <int>31</int> <string>2</string> </void> <void method="put"> <int>20031</int> <boolean>true</boolean> </void> <void method="put"> <int>10031</int> <boolean>true</boolean> </void> <void method="put"> <int>30031</int> <boolean>true</boolean> </void> <void method="put"> <int>50031</int> <boolean>false</boolean> </void> <void method="put"> <int>32</int> <string>1;2;3;4</string> </void> <void method="put"> <int>20032</int> <boolean>true</boolean> </void> <void method="put"> <int>10032</int> <boolean>true</boolean> </void> <void method="put"> <int>30032</int> <boolean>true</boolean> </void> <void method="put"> <int>50032</int> <boolean>false</boolean> </void> <void method="put"> <int>33</int> <string></string> </void> <void method="put"> <int>20033</int> <boolean>false</boolean> </void> <void method="put"> <int>10033</int> <boolean>true</boolean> </void> <void method="put"> <int>30033</int> <boolean>true</boolean> </void> <void method="put"> <int>50033</int> <boolean>false</boolean> </void> <void method="put"> <int>34</int> <string></string> </void> <void method="put"> <int>20034</int> <boolean>true</boolean> </void> <void method="put"> <int>10034</int> <boolean>false</boolean> </void> <void method="put"> <int>30034</int> <boolean>true</boolean> </void> <void method="put"> <int>50034</int> <boolean>false</boolean> </void> <void method="put"> <int>38</int> <string>-1683721591</string> </void> <void method="put"> <int>20038</int> <boolean>true</boolean> </void> <void method="put"> <int>10038</int> <boolean>true</boolean> </void> <void method="put"> <int>30038</int> <boolean>true</boolean> </void> <void method="put"> <int>50038</int> <boolean>false</boolean> </void> <void method="put"> <int>37</int> <string>-1683721591</string> </void> <void method="put"> <int>20037</int> <boolean>true</boolean> </void> <void method="put"> <int>10037</int> <boolean>true</boolean> </void> <void method="put"> <int>30037</int> <boolean>true</boolean> </void> <void method="put"> <int>50037</int> <boolean>false</boolean> </void> <void method="put"> <int>98</int> <string></string> </void> <void method="put"> <int>20098</int> <boolean>false</boolean> </void> <void method="put"> <int>10098</int> <boolean>false</boolean> </void> <void method="put"> <int>30098</int> <boolean>true</boolean> </void> <void method="put"> <int>50098</int> <boolean>false</boolean> </void> <void method="put"> <int>99</int> <string></string> </void> <void method="put"> <int>20099</int> <boolean>false</boolean> </void> <void method="put"> <int>10099</int> <boolean>false</boolean> </void> <void method="put"> <int>30099</int> <boolean>true</boolean> </void> <void method="put"> <int>50099</int> <boolean>false</boolean> </void> <void method="put"> <int>97</int> <string></string> </void> <void method="put"> <int>20097</int> <boolean>false</boolean> </void> <void method="put"> <int>10097</int> <boolean>false</boolean> </void> <void method="put"> <int>30097</int> <boolean>true</boolean> </void> <void method="put"> <int>50097</int> <boolean>false</boolean> </void> <void method="put"> <int>91</int> <string></string> </void> <void method="put"> <int>20091</int> <boolean>false</boolean> </void> <void method="put"> <int>10091</int> <boolean>false</boolean> </void> <void method="put"> <int>30091</int> <boolean>true</boolean> </void> <void method="put"> <int>50091</int> <boolean>false</boolean> </void> <void method="put"> <int>94</int> <string>-1</string> </void> <void method="put"> <int>20094</int> <boolean>false</boolean> </void> <void method="put"> <int>10094</int> <boolean>false</boolean> </void> <void method="put"> <int>30094</int> <boolean>true</boolean> </void> <void method="put"> <int>50094</int> <boolean>false</boolean> </void> <void method="put"> <int>93</int> <string>-1</string> </void> <void method="put"> <int>20093</int> <boolean>false</boolean> </void> <void method="put"> <int>10093</int> <boolean>false</boolean> </void> <void method="put"> <int>30093</int> <boolean>true</boolean> </void> <void method="put"> <int>50093</int> <boolean>false</boolean> </void> <void method="put"> <int>89</int> <string></string> </void> <void method="put"> <int>20089</int> <boolean>false</boolean> </void> <void method="put"> <int>10089</int> <boolean>false</boolean> </void> <void method="put"> <int>30089</int> <boolean>true</boolean> </void> <void method="put"> <int>50089</int> <boolean>false</boolean> </void> <void method="put"> <int>88</int> <string></string> </void> <void method="put"> <int>20088</int> <boolean>false</boolean> </void> <void method="put"> <int>10088</int> <boolean>false</boolean> </void> <void method="put"> <int>30088</int> <boolean>true</boolean> </void> <void method="put"> <int>50088</int> <boolean>false</boolean> </void> <void method="put"> <int>87</int> <string></string> </void> <void method="put"> <int>20087</int> <boolean>false</boolean> </void> <void method="put"> <int>10087</int> <boolean>false</boolean> </void> <void method="put"> <int>30087</int> <boolean>true</boolean> </void> <void method="put"> <int>50087</int> <boolean>false</boolean> </void> <void method="put"> <int>12</int> <string></string> </void> <void method="put"> <int>20012</int> <boolean>true</boolean> </void> <void method="put"> <int>10012</int> <boolean>true</boolean> </void> <void method="put"> <int>30012</int> <boolean>true</boolean> </void> <void method="put"> <int>50012</int> <boolean>false</boolean> </void> <void method="put"> <int>16</int> <string>United States</string> </void> <void method="put"> <int>20016</int> <boolean>true</boolean> </void> <void method="put"> <int>10016</int> <boolean>true</boolean> </void> <void method="put"> <int>30016</int> <boolean>true</boolean> </void> <void method="put"> <int>50016</int> <boolean>false</boolean> </void> <void method="put"> <int>10090</int> <boolean>true</boolean> </void> <void method="put"> <int>90</int> <string>0</string> </void> <void method="put"> <int>10002</int> <boolean>false</boolean> </void> <void method="put"> <int>2</int> <string>false</string> </void> <void method="put"> <int>20002</int> <boolean>false</boolean> </void> <void method="put"> <int>60</int> <string></string> </void> <void method="put"> <string>REVERSEFFIELDCHECKS</string> <boolean>false</boolean> </void> <void method="put"> <string>ALLOW_MERGEDN_WEBSERVICES</string> <boolean>true</boolean> </void> <void method="put"> <string>ALLOW_MULTI_VALUE_RDNS</string> <boolean>false</boolean> </void> <void method="put"> <int>201</int> <string></string> </void> <void method="put"> <int>20201</int> <boolean>false</boolean> </void> <void method="put"> <int>30201</int> <boolean>false</boolean> </void> <void method="put"> <int>202</int> <string></string> </void> <void method="put"> <int>20202</int> <boolean>false</boolean> </void> <void method="put"> <int>30202</int> <boolean>false</boolean> </void> <void method="put"> <int>10092</int> <boolean>false</boolean> </void> <void method="put"> <string>USEEXTENSIONDATA</string> <boolean>false</boolean> </void> <void method="put"> <string>PSD2QCSTATEMENT</string> <boolean>false</boolean> </void> <void method="put"> <int>10035</int> <boolean>false</boolean> </void> <void method="put"> <string>PRINTINGUSE</string> <boolean>false</boolean> </void> <void method="put"> <string>USERNOTIFICATIONS</string> <object class="java.util.ArrayList"/> </void> <void method="put"> <int>10028</int> <boolean>false</boolean> </void> <void method="put"> <int>20028</int> <boolean>false</boolean> </void> <void method="put"> <int>28</int> <string>false</string> </void> <void method="put"> <int>20035</int> <boolean>false</boolean> </void> <void method="put"> <int>35</int> <string>false</string> </void> <void method="put"> <string>PRINTINGREQUIRED</string> <boolean>false</boolean> </void> <void method="put"> <string>PRINTINGDEFAULT</string> <boolean>false</boolean> </void> </object> </java> [ejbca@ca tmp]$ and I added an entry: ejbca@ca ejbca]$ ./bin/ejbca.sh ra listnewendentities New end entity: jeremy, "CN=Jeremy Hansen,O=CLX,C=US", "", je...@cl...rp, 10, 1, 2 [ejbca@ca ejbca]$ But when I do the batch processing, I see no error, but there’s no p12 file: ejbca@ca ejbca]$ ./bin/ejbca.sh batch jeremy Generating keys in directory /opt/ejbca-ce-main/p12. ejbca@ca ejbca]$ ls p12/ superadmin.p12 tomcat.jks truststore.jks [ejbca@ca ejbca]$ So I’m trying to figure out what I’m doing wrong. The end goal is to use client certificates to authenticate mail in the same way that Ejbca asked for the p12 cert for the SuperAdmin for authentication. |
From: Tomas G. <tom...@pr...> - 2021-07-07 12:29:24
|
Are you referring to these installation instrutions? https://doc.primekey.com/ejbca/ejbca-installation/installing-ejbca/installing-ejbca-as-an-ra-or-va If you have installed the CA, you will have JKS files in the p12 directory of EJBCA. These are the TLS server keystore and the TLS truststore. You can create new TLS certificates for the VA, which is what you would do in a production environment. Issue new TLS keystores for the VA. "ant deploy-keystore" simply copies these files to WildFly. The appserver installation instructions for TLS: https://doc.primekey.com/ejbca/ejbca-installation/application-servers/wildfly-18-jboss-eap-7-3#WildFly18/JBossEAP7.3-HTTP(S)ListenerConfigurationwith3-portSeparation uses keystore type = JKS, not PKCS#12. If you know what you are doing, you may as well use PKCS#12 if you like. You then need to create the TLS keystores in PKCS#12 format instead of JKS. When issuing the TLS keystores for the VA from the CA you can directly in EJBCA choose if you want JKS or PKCS#12 format. Choose the format that fits your desired configuration. > So I am a bit stumped about how to proceed? * Issue TLS keystores for the VA from the CA * Use these in the TLS configuration for your selected application server > 2. EJBCA Properties. As noted here: https://doc.primekey.com/ejbca/ejbca-installation/installing-ejbca/installing-ejbca-as-an-ra-or-va You probably only need web.properties and web.reqcertindb=false Cheers, Tomas ________________________________ From: Private <pr...@ad...> Sent: Tuesday, July 6, 2021 11:27 AM To: ejb...@li... <ejb...@li...> Subject: [Ejbca-develop] Setting up stand alone OCSP responder CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. Hi, I am trying to set up an ocsp responder for an existing CA to move from crls to OCSP. The CA is currently run on CE_6 I am setting up the ocsp responder using the latest CE_7. I have: - Working wildfly following the documentation EJBCA / EJBCA Installation / Application Servers. I hove two issues: 1. Keystores / Truststores In the section 'Configure TLS' it has the commands: /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsKS:add(path="keystore/keystore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsKeystorePassword},type=PKCS12)' /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsTS:add(path="keystore/truststore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsTruststorePassword},type=PKCS12)' So the keystore and truststore on the VA are in PKCS12 format, however, the keystore and truststore are in JKS format. So when you reach the 'Installing EJBCA as an RA or VA' stage, the instructing is: "If you've already created a key store as part of the initial installation of EJBCA on another instance, copy it to the p12 directory in EJBCA" If I understand things correctly, if I do that I will be copying a JKS keystore when the VA expects a PKCS12 . I have tried creating a PKCS12 version of the existing keystore using keytool: keytool -importkeystore -srckeystore [MY_KEYSTORE.jks] -destkeystore [MY_FILE.p12] -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12] But the command fails because the management certificate is a trustedcertentry. So I am a bit stumped about how to proceed? 2. EJBCA Properties. I am not clear from the documentation which properties files are required. The later stages of the setup allude to using the web interface on the VA to do some of the configuration. Exactly which properties files are required on the VA? Thanks _______________________________________________ Ejbca-develop mailing list Ejb...@li... https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fejbca-develop&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C09fcda291eba4ed0dcbc08d940610df1%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637611608445097712%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Ij8ng5GQNjLn4ys6%2FvGpypsIrbIhz40XiXL%2FxPmWeBo%3D&reserved=0 |
From: Private <pr...@ad...> - 2021-07-06 09:32:43
|
Hi, I am trying to set up an ocsp responder for an existing CA to move from crls to OCSP. The CA is currently run on CE_6 I am setting up the ocsp responder using the latest CE_7. I have: - Working wildfly following the documentation EJBCA / EJBCA Installation / Application Servers. I hove two issues: 1. Keystores / Truststores In the section 'Configure TLS' it has the commands: /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsKS:add(path="keystore/keystore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsKeystorePassword},type=PKCS12)' /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsTS:add(path="keystore/truststore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsTruststorePassword},type=PKCS12)' So the keystore and truststore on the VA are in PKCS12 format, however, the keystore and truststore are in JKS format. So when you reach the 'Installing EJBCA as an RA or VA' stage, the instructing is: "If you've already created a key store as part of the initial installation of EJBCA on another instance, copy it to the p12 directory in EJBCA" If I understand things correctly, if I do that I will be copying a JKS keystore when the VA expects a PKCS12 . I have tried creating a PKCS12 version of the existing keystore using keytool: keytool -importkeystore -srckeystore [MY_KEYSTORE.jks] -destkeystore [MY_FILE.p12] -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12] But the command fails because the management certificate is a trustedcertentry. So I am a bit stumped about how to proceed? 2. EJBCA Properties. I am not clear from the documentation which properties files are required. The later stages of the setup allude to using the web interface on the VA to do some of the configuration. Exactly which properties files are required on the VA? Thanks |
From: Jeremy H. <je...@sk...> - 2021-07-06 04:02:44
|
So even though the video I followed kind of pointed me in the right direction, it was definitely missing a lot of information. It turns out my certificate template was just wrong for doing SSL certificates. This bit of documentation got me straightened out: https://doc.primekey.com/ejbca743/ejbca-operations/ejbca-operations-guide/ca-operations-guide/managing-certificate-profiles/create-a-certificate-profile-for-ssl-servers One thing that be useful is an explanation of what the pre-existing certificate profiles were designed to do, so maybe I could clone those profiles based on the kind of certificate I’m trying to generate: List of Certificate Profiles Name Actions ENDUSER OCSPSIGNER ROOTCA SERVER SUBCA Is there docs on what these profiles are intended for? Some are obvious, but what is “SERVER” for example? Is this for SSL certs? In terms of the best profile for the service, at the moment I need SSL certs for http as well as things like imap and smtp. So would the same certificate profile apply to these other types of services? I didn’t know if some of the knobs and switches in the profiles were better tuned for different types of services. I’m using the latest community release and I used the ./ejbca/bin/extra/setup script which seems to work fine. I was initially using the docker images but it seems a bit cumbersome for using the CLI for operations, which I haven’t gotten in to yet. Thanks -jeremy > On Monday, Jul 05, 2021 at 6:28 AM, Moser Benjamin <B....@co... (mailto:B....@co...)> wrote: > > Hi Jeremy, > > > > > > Please provide more information about the configuration you made on your PKI instances incl. certificate and end entity profile. It is of course difficult to guess what you have done exactly. I didn’t click the youtube link below. The script you provided in OpenSSL create an TLS server certificate for a single domain. Am I right? It does allow you almost everything. EJBCA doesn’t work the same simple way. > > > > > > EJBCA certificate profile define the key creation, revocation and retirement due to a validity time. Let’s call it certificate and lifetime management. > > > EJBCA end entity profile define the domain user information and key store type as well as the certificate profile to use. Let’s call it user management. > > > By default configuration a single user certificate exists only once. > > > > > > To give you a hint what is wrong in the current setup we have to provide details on the configuration. > > > > > > Thanks > > > Benjamin Moser > > > Lead Security Architect and OSS Officer > > > > > > > > > > Von: Jeremy Hansen <je...@sk...> > Gesendet: Montag, 5. Juli 2021 01:16 > An: Ejb...@li... > Betreff: [External] [Ejbca-develop] Issue with certificates generated by Ejbca > > > > > > > > CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. > > > > > > > I’m working toward understanding Ejbca. Following this YouTube video, I’m able to get to the point of generating SSL certificates: > > > > > > > > https://youtu.be/d-8SqUT8Mn4 (https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%2Fd-8SqUT8Mn4&data=04%7C01%7Cb.moser%40commend.com%7C893ad7e0455a45d4c73c08d93f41d452%7C13b1ddb756454e7fbe663171548559da%7C0%7C0%7C637610374702483223%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=as8XfW678%2FNgXCakYbG7V%2FijjHtBpuIQUaeRl%2B0%2FFjc%3D&reserved=0) > > > > > > > > but the resulting certificate still appears to be invalid. Using openssl doesn’t seem to have the same issue and when I generate my own CA using openssl with a corresponding certificate, it works fine. So I guess what I’m asking is how do I generate a CA and SSL cert that results in a trusted certificate for internal services. Here is the script just using straight openssl that works fine: > > > #!/bin/sh if [ "$#" -ne 1 ] then echo "Usage: Must supply a domain" exit 1 fi DOMAIN=$1 cd ~/certs openssl genrsa -out $DOMAIN.key 2048 openssl req -new -key $DOMAIN.key -out $DOMAIN.csr cat > $DOMAIN.ext << EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = $DOMAIN EOF openssl x509 -req -in $DOMAIN.csr -CA ../myCA.pem -CAkey ../myCA.key -CAcreateserial \ -out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext > > > Thanks > > > > -jeremy > > > > > > > > > > > > > > > > > > > > _______________________________________________ > Ejbca-develop mailing list > Ejb...@li... > https://lists.sourceforge.net/lists/listinfo/ejbca-develop |
From: Moser B. <B....@co...> - 2021-07-05 11:27:57
|
Hi Jeremy, Please provide more information about the configuration you made on your PKI instances incl. certificate and end entity profile. It is of course difficult to guess what you have done exactly. I didn't click the youtube link below. The script you provided in OpenSSL create an TLS server certificate for a single domain. Am I right? It does allow you almost everything. EJBCA doesn't work the same simple way. EJBCA certificate profile define the key creation, revocation and retirement due to a validity time. Let's call it certificate and lifetime management. EJBCA end entity profile define the domain user information and key store type as well as the certificate profile to use. Let's call it user management. By default configuration a single user certificate exists only once. To give you a hint what is wrong in the current setup we have to provide details on the configuration. Thanks Benjamin Moser Lead Security Architect and OSS Officer Von: Jeremy Hansen <je...@sk...> Gesendet: Montag, 5. Juli 2021 01:16 An: Ejb...@li... Betreff: [External] [Ejbca-develop] Issue with certificates generated by Ejbca CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I'm working toward understanding Ejbca. Following this YouTube video, I'm able to get to the point of generating SSL certificates: https://youtu.be/d-8SqUT8Mn4<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%2Fd-8SqUT8Mn4&data=04%7C01%7Cb.moser%40commend.com%7C893ad7e0455a45d4c73c08d93f41d452%7C13b1ddb756454e7fbe663171548559da%7C0%7C0%7C637610374702483223%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=as8XfW678%2FNgXCakYbG7V%2FijjHtBpuIQUaeRl%2B0%2FFjc%3D&reserved=0> but the resulting certificate still appears to be invalid. Using openssl doesn't seem to have the same issue and when I generate my own CA using openssl with a corresponding certificate, it works fine. So I guess what I'm asking is how do I generate a CA and SSL cert that results in a trusted certificate for internal services. Here is the script just using straight openssl that works fine: #!/bin/sh if [ "$#" -ne 1 ] then echo "Usage: Must supply a domain" exit 1 fi DOMAIN=$1 cd ~/certs openssl genrsa -out $DOMAIN.key 2048 openssl req -new -key $DOMAIN.key -out $DOMAIN.csr cat > $DOMAIN.ext << EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = $DOMAIN EOF openssl x509 -req -in $DOMAIN.csr -CA ../myCA.pem -CAkey ../myCA.key -CAcreateserial \ -out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext Thanks -jeremy |
From: Jeremy H. <je...@sk...> - 2021-07-04 23:16:28
|
I’m working toward understanding Ejbca. Following this YouTube video, I’m able to get to the point of generating SSL certificates: https://youtu.be/d-8SqUT8Mn4 but the resulting certificate still appears to be invalid. Using openssl doesn’t seem to have the same issue and when I generate my own CA using openssl with a corresponding certificate, it works fine. So I guess what I’m asking is how do I generate a CA and SSL cert that results in a trusted certificate for internal services. Here is the script just using straight openssl that works fine: #!/bin/sh if [ "$#" -ne 1 ] then echo "Usage: Must supply a domain" exit 1 fi DOMAIN=$1 cd ~/certs openssl genrsa -out $DOMAIN.key 2048 openssl req -new -key $DOMAIN.key -out $DOMAIN.csr cat > $DOMAIN.ext << EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = $DOMAIN EOF openssl x509 -req -in $DOMAIN.csr -CA ../myCA.pem -CAkey ../myCA.key -CAcreateserial \ -out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext Thanks -jeremy |
From: Jeremy H. <je...@sk...> - 2021-07-02 18:39:01
|
Thank you. The documentation literally takes me in circles. This part sounds great: “This Quick Start Guide covers all levels of the CA structure in EJBCA from the Crypto Tokens to the End Entities themselves.” but unfortunately from this point I can’t find the section that actually takes me through those steps. This video, https://youtu.be/d-8SqUT8Mn4, has gotten me further in understanding how to generate a certificate than any of the documentation, even though the author of this video makes a bunch a silly mistakes toward the end. I feel like what I’m looking for is staring me in the face, but when I click on a link, it just seems like the documentation explains what it’s about to show me and then never gets to it. Then I click on another link and I’m back at the beginning. So if there is a direct link to something that shows me this: “ This Quick Start Guide covers all levels of the CA structure in EJBCA from the Crypto Tokens to the End Entities themselves.” I’d love to follow that guide. Thanks > On Jul 2, 2021, at 7:28 AM, Tomas Gustavsson via Ejbca-develop <ejb...@li...> wrote: > > > Perhaps the cloud quick start guide is something worth reading? > https://doc.primekey.com/ejbca-cloud/ejbca-cloud-aws/quick-start-guide > > > Cheers, > Tomas > From: Jeremy Hansen <je...@sk...> > Sent: Wednesday, June 30, 2021 5:19 AM > To: Ejb...@li... <Ejb...@li...> > Subject: [Ejbca-develop] Simplified tutorial? > > CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email In...@ke... with any questions. > > > The only experience I have with managed CAs is Hashicorp Vault and my experience was more from an end user’s perspective. > > My primary use with Vault was pulling certificates for ssl authentication with Apache Kafka. > > Now I’m faced with the challenge of running my own CA to maintain certificates for various internal services, such as internal websites, mail server (ssl imap, smtp, etc). > > A step by step tutorial to get from installation to issuing functional ssl certs would be super helpful in getting pointed in the right direction. > Does something equivalent to Vault Agent exist in the Ejbca world? > > I understand this information is embedded in the documentation but the docs seem to be geared toward someone with more in depth knowledge of the whole PKI structure. I hope to get to that point but right now a jump start would be very nice. > > Thanks > -jeremy > > > _______________________________________________ > Ejbca-develop mailing list > Ejb...@li... > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fejbca-develop&data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C9b57c0c6984c490c7d9d08d93d46f6a7%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637608198077802428%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=6K3rpwDE12g2561rba0rC39QpWYajVxD6xMZlJvLPZ0%3D&reserved=0 > _______________________________________________ > Ejbca-develop mailing list > Ejb...@li... > https://lists.sourceforge.net/lists/listinfo/ejbca-develop |