ejbca-develop — Development discussions

Re: [Ejbca-develop] New, Experimental Registration Authority For EJBCA

[Christian F. <pu...@fe...>]

Tomas,

there are plans to do so, pls. see
https://github.com/ip6li/registration-authority/issues/7
At this time there are problems to integrate Apache Shiro into async
architecture of latest version (not available to the public yet)

At least username/password via oauth2 will be implemented.

Regards
Christian

Am 08.01.2016 um 10:24 schrieb Tomas Gustavsson:
> Nice demo. Did you consider any authentication or approval mechanism for
> enrollment?
> 
> Regards,
> Tomas

Re: [Ejbca-develop] New, Experimental Registration Authority For EJBCA

[Tomas G. <to...@pr...>]

Nice demo. Did you consider any authentication or approval mechanism for enrollment? 

Regards, 
Tomas 


On January 5, 2016 11:11:49 AM GMT+01:00, Christian Felsing <pu...@fe...> wrote:
>Am 04.01.2016 um 14:55 schrieb Tomas Gustavsson:
>> Cool, I'll try it out.
>Today it got some improvements e.g. more configurable and validating
>request before sending to EJBCA.
>
>> Did you see this btw, code to help people create CSRs.
>> https://csrhelp.peculiarventures.com/
>
>I did not know that, but also an interesting solution even it kills
>mobile devices performance (AngularJS)
>My solution is more plain vanilla JavaScript and may be usable even
>with
>mobile devices - if css is slightly improved and it has enough
>performance to generate a RSA key.
>
>I set up a demo with EJBCA backend on https://demo.ip6.li/demo/
>
>best regards
>Christian
>
>
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] EJBCA newbie: retrieval question

[Quintin B. <qui...@ja...>]

Good morning,

I think the public web only allows retrieving the *certificate* for any user, and not the private key as well. The certificate is part of the public component.

Quintin

On 2016-01-08 08:04, Benedikt Weyer wrote:
> good morning, why can i retrieve any certificate (even the superadmin)
> in ejbca's public web interface without authenitification? am using
> ejbca_ce_6_3_1_1, jboss-as-7.1.1.Final, H2,  openjdk-7 on debian 8.
> thanx a lot in advance.
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

------------------------------------------------------------------------------
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

JACKLIN ENTERPRISES
Quintin Beukes
Tel: +27 11 265 4442
Fax: +27 11 314 2984
Email: qui...@ja...

@|from|wwwhomepage|@

This e-mail may contain confidential information belonging to the sender which is legally privileged. It is the responsibility of the recipient to ensure that any e-mails or attachments are virus free as Jacklin Enterprises accepts no responsibility. Should you not be the intended recipient then any disclosure, copying, distribution or the taking of any action in reliance of the contents of this email is strictly prohibited. If you have received this transmission in error, please notify the sender immediately. 

Jacklin Enterprises Limited is registered in England No. 4398837 Registered office: 3rd Floor, 12 Gough Square, London, EC4A 3DW. VAT Registration No: 831 0256 68.

Please consider the environment before printing this email.

Re: [Ejbca-develop] EJBCA newbie: retrieval question

[Tomas G. <to...@pr...>]

Hi,

It's because certificates are by design "public". There is no security
information in them by "X.509/PKI" design, as the security lies with the
private key. It's common to publish all issued user certificates in a
directory for example.

You can of course easily restrict access to public web by removign
access to publicly accessible ports.

Cheers,
Tomas
**********
PrimeKey Solutions AB
Lundagatan 16, 171 63 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2016-01-08 08:04, Benedikt Weyer wrote:
> good morning, why can i retrieve any certificate (even the superadmin)
> in ejbca's public web interface without authenitification? am using
> ejbca_ce_6_3_1_1, jboss-as-7.1.1.Final, H2,  openjdk-7 on debian 8.
> thanx a lot in advance.
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] EJBCA newbie: retrieval question

[Benedikt W. <ben...@t-...>]

good morning, why can i retrieve any certificate (even the superadmin)
in ejbca's public web interface without authenitification? am using
ejbca_ce_6_3_1_1, jboss-as-7.1.1.Final, H2,  openjdk-7 on debian 8.
thanx a lot in advance.

[Ejbca-develop] Running EJBCA with systemd

[Christian F. <pu...@fe...>]

Hello,

this is a ejbca.service file which works with EJBCA, it should be
located at /usr/lib/systemd/system and works with CentOS7.2.

---cut here--
[Unit]
Description=EJBCA PKI
After=network.target mariadb.service

[Service]
Type=simple
User=ejbca
Group=ejbca
WorkingDirectory=/home/ejbca
ExecStart=/home/ejbca/jboss/bin/standalone.sh -b 127.0.0.1
ExecStop=/home/ejbca/jboss/bin/jboss-cli.sh --connect command=:shutdown
Restart=on-failure
RestartSec=300s

[Install]
WantedBy=multi-user.target
---cut here--

It assumes:

* EJBCA is running as user ejbca
* JBoss is installed on /home/ejbca/jboss
* not forking
* database is MariaDB

see also https://gist.github.com/ip6li/1b92a019567afdb5ff62

Christian

Re: [Ejbca-develop] New, Experimental Registration Authority For EJBCA

[Christian F. <pu...@fe...>]

Am 04.01.2016 um 14:55 schrieb Tomas Gustavsson:
> Cool, I'll try it out.
Today it got some improvements e.g. more configurable and validating
request before sending to EJBCA.

> Did you see this btw, code to help people create CSRs.
> https://csrhelp.peculiarventures.com/

I did not know that, but also an interesting solution even it kills
mobile devices performance (AngularJS)
My solution is more plain vanilla JavaScript and may be usable even with
mobile devices - if css is slightly improved and it has enough
performance to generate a RSA key.

I set up a demo with EJBCA backend on https://demo.ip6.li/demo/

best regards
Christian

Re: [Ejbca-develop] New, Experimental Registration Authority For EJBCA

[Tomas G. <to...@pr...>]

Cool, I'll try it out.

Did you see this btw, code to help people create CSRs.
https://csrhelp.peculiarventures.com/

Regards,
Tomas

On 2016-01-02 14:19, Christian Felsing wrote:
> Hello,
> 
> while playing around with WebcryptoAPI and EJBCA I made a small Java
> software which presents a simple playground for EJBCA webservice and
> WebcryptoAPI to user.
> 
> Feel free to play around with that code:
> https://github.com/ip6li/registration-authority
> 
> best regards
> Christian Felsing
> 
> 
> 
> ------------------------------------------------------------------------------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] New, Experimental Registration Authority For EJBCA

[Christian F. <pu...@fe...>]

Hello,

while playing around with WebcryptoAPI and EJBCA I made a small Java
software which presents a simple playground for EJBCA webservice and
WebcryptoAPI to user.

Feel free to play around with that code:
https://github.com/ip6li/registration-authority

best regards
Christian Felsing

Re: [Ejbca-develop] PKCS7 indefinite encoding with embedded 00 00 octets breaks pyasn1 parser

[Tomas G. <to...@pr...>]

Also are you sure it's the indefinite-length vs definite length, and not
something else pyasn1 doesn't like?
It could for instance be content encapsulation that can be done in a
couple of ways.

It's not possible to test this on a command line? (i.e. for me without
having to write a python program).

Cheers,
Tomas

On 2015-12-17 10:34, Anthony Alba wrote:
> When using WSDL certificateRequest () with PKCS7WITHCHAIN, the
> returned structure use indefinite length encoding:
> 
>    0:d=0  hl=2 l=inf  cons: SEQUENCE
>     2:d=1  hl=2 l=   9 prim: OBJECT            :pkcs7-signedData
>    13:d=1  hl=2 l=inf  cons: cont [ 0 ]
>    15:d=2  hl=2 l=inf  cons: SEQUENCE
>    17:d=3  hl=2 l=   1 prim: INTEGER           :01
>    20:d=3  hl=2 l=  11 cons: SET
>    22:d=4  hl=2 l=   9 cons: SEQUENCE
>    24:d=5  hl=2 l=   5 prim: OBJECT            :sha1
> 
> however the contents of the data structure, "d=1 cont[0]"  contains 00
> 00 so that some ASN.1 parsers terminate , they treat 00 00 as
> end-of-content and drop bytes. Is the ASN.1 stream malformed?
> 
> For example pyasn1 will strip out all 00 00 in stream and throw the
> following error:
> 
> pkcs7_asn1  = decoder.decode(<PKCS7_DER_FROM_EJBCA>, asn1Spec =
> rfc2315.ContentInfo())
> 
> pyasn1.error.SubstrateUnderrunError: No EOO seen before substrate ends
> 
> Could you consider using definite length encoding?
> 
> However, OpenSSL utility pkcs7 handles these PKCS7 streams fine: maybe
> it assumes the 2nd component continues to the end of file.
> 
> Anthony
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

Re: [Ejbca-develop] PKCS7 indefinite encoding with embedded 00 00 octets breaks pyasn1 parser

[Tomas G. <to...@pr...>]

Hi,

Which version of EJBCA do you use?

We produce the PKCS#7 using BouncyCastle standard routines, which should
really be compatible with most clients.

Regards,
Tomas

On 2015-12-17 10:34, Anthony Alba wrote:
> When using WSDL certificateRequest () with PKCS7WITHCHAIN, the
> returned structure use indefinite length encoding:
> 
>    0:d=0  hl=2 l=inf  cons: SEQUENCE
>     2:d=1  hl=2 l=   9 prim: OBJECT            :pkcs7-signedData
>    13:d=1  hl=2 l=inf  cons: cont [ 0 ]
>    15:d=2  hl=2 l=inf  cons: SEQUENCE
>    17:d=3  hl=2 l=   1 prim: INTEGER           :01
>    20:d=3  hl=2 l=  11 cons: SET
>    22:d=4  hl=2 l=   9 cons: SEQUENCE
>    24:d=5  hl=2 l=   5 prim: OBJECT            :sha1
> 
> however the contents of the data structure, "d=1 cont[0]"  contains 00
> 00 so that some ASN.1 parsers terminate , they treat 00 00 as
> end-of-content and drop bytes. Is the ASN.1 stream malformed?
> 
> For example pyasn1 will strip out all 00 00 in stream and throw the
> following error:
> 
> pkcs7_asn1  = decoder.decode(<PKCS7_DER_FROM_EJBCA>, asn1Spec =
> rfc2315.ContentInfo())
> 
> pyasn1.error.SubstrateUnderrunError: No EOO seen before substrate ends
> 
> Could you consider using definite length encoding?
> 
> However, OpenSSL utility pkcs7 handles these PKCS7 streams fine: maybe
> it assumes the 2nd component continues to the end of file.
> 
> Anthony
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] PKCS7 indefinite encoding with embedded 00 00 octets breaks pyasn1 parser

[Anthony A. <asc...@gm...>]

When using WSDL certificateRequest () with PKCS7WITHCHAIN, the
returned structure use indefinite length encoding:

   0:d=0  hl=2 l=inf  cons: SEQUENCE
    2:d=1  hl=2 l=   9 prim: OBJECT            :pkcs7-signedData
   13:d=1  hl=2 l=inf  cons: cont [ 0 ]
   15:d=2  hl=2 l=inf  cons: SEQUENCE
   17:d=3  hl=2 l=   1 prim: INTEGER           :01
   20:d=3  hl=2 l=  11 cons: SET
   22:d=4  hl=2 l=   9 cons: SEQUENCE
   24:d=5  hl=2 l=   5 prim: OBJECT            :sha1

however the contents of the data structure, "d=1 cont[0]"  contains 00
00 so that some ASN.1 parsers terminate , they treat 00 00 as
end-of-content and drop bytes. Is the ASN.1 stream malformed?

For example pyasn1 will strip out all 00 00 in stream and throw the
following error:

pkcs7_asn1  = decoder.decode(<PKCS7_DER_FROM_EJBCA>, asn1Spec =
rfc2315.ContentInfo())

pyasn1.error.SubstrateUnderrunError: No EOO seen before substrate ends

Could you consider using definite length encoding?

However, OpenSSL utility pkcs7 handles these PKCS7 streams fine: maybe
it assumes the 2nd component continues to the end of file.

Anthony

Re: [Ejbca-develop] NullPointerException in CRL retrieval

[Ralf H. <rh...@hc...>]

Yes i see it now. Clients try to fetch a delta CRL. Thanks. Thats enough :-)

-----Ursprüngliche Nachricht-----
Von: Tomas Gustavsson [mailto:to...@pr...] 
Gesendet: Mittwoch, 16. Dezember 2015 15:42
An: ejb...@li...
Betreff: Re: [Ejbca-develop] NullPointerException in CRL retrieval


Ok, can it then be an invalid URL in some cases that makes them try to fetch
a deltaCRL. You can experiment by clicking on the links in publicweb. If
there is no CRL, or deltaCRL the corresponding link will give this message.

/Tomas

On 2015-12-16 03:49, Ralf Hornik wrote:
> Hi, yes because there are also successfull retrievals but with serial  >
0:
> 
> 2015-12-11 14:37:56,573 DEBUG [org.ejbca.ui.web.RequestHelper] 
> (default
> task-7) Setting encoding to default value: UTF-8
> 2015-12-11 14:37:56,576 INFO
> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-7) 
> Retrieved CRL from issuer 'CN=Root CA,O=MyCompany,C=DE', with CRL 
> number 153.
> 2015-12-11 14:37:56,578 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
> (default task-7) Sent latest CRL to client at 10.51.226.125
> 
> I wonder why and what process wants to look up a CRL with number 0. 
> What is CertDistServlet used for? I guess its CDP lookup from the end
devices.
> 
> -----Ursprüngliche Nachricht-----
> Von: Tomas Gustavsson [mailto:to...@pr...]
> Gesendet: Montag, 14. Dezember 2015 18:37
> An: ejb...@li...
> Betreff: Re: [Ejbca-develop] NullPointerException in CRL retrieval
> 
> 
> Hi are you sure the "CN=Root CA,O=MyCompany,C=DE" have CRL available, 
> and not just a Sub CA?
> 
> Regards,
> Tomas
> 
> On 2015-12-11 07:32, Ralf Hornik wrote:
>> Hi,
>>
>> i just noticed that there are several exceptions from various clients 
>> in the wildfly log:
>>
>> 2015-12-11 14:36:18,817 DEBUG [org.ejbca.ui.web.RequestHelper] 
>> (default
>> task-31) Setting encoding to default value: UTF-8
>> 2015-12-11 14:36:18,820 INFO
>> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-31) 
>> Error retrieving CRL for issuer 'CN=Root CA,O=MyCompany,C=DE' with 
>> CRL
> number 0.
>> 2015-12-11 14:36:18,820 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
>> (default task-31) Error sending latest CRL to 10.51.18.138: :
>> java.lang.NullPointerException
>>
>> Other log entries with CRL number >0 are successfull.
>> The clients are mostly windows PCs. I think they try to lookup the 
>> CDP and want to retrieve the CRL.
>>
>> Any hints why ejbca tries to send a CRL with serial 0? The current 
>> CRL number is 15.
>> Thanks and best regards
>>
>> Ralf Hornik
>> Hosting Consulting Services
>> Abt-Gallus-Str. 23
>> 86609 Donauwörth
>> Tel: +49 906 20430 12
>> Fax: +49 906 20430 15
>> Mobil: +49 151 50721262
>> email: rh...@hc...
>> www: http://www.hcservices.de
>>
>>
>>
>> ---------------------------------------------------------------------
>> -
>> --------
>>
>>
>>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
> 
> ----------------------------------------------------------------------
> ------
> --
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 
> 
> 
> ----------------------------------------------------------------------
> --------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

----------------------------------------------------------------------------
--
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] NullPointerException in CRL retrieval

[Tomas G. <to...@pr...>]

Ok, can it then be an invalid URL in some cases that makes them try to
fetch a deltaCRL. You can experiment by clicking on the links in
publicweb. If there is no CRL, or deltaCRL the corresponding link will
give this message.

/Tomas

On 2015-12-16 03:49, Ralf Hornik wrote:
> Hi, yes because there are also successfull retrievals but with serial  > 0:
> 
> 2015-12-11 14:37:56,573 DEBUG [org.ejbca.ui.web.RequestHelper] (default
> task-7) Setting encoding to default value: UTF-8
> 2015-12-11 14:37:56,576 INFO
> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-7)
> Retrieved CRL from issuer 'CN=Root CA,O=MyCompany,C=DE', with CRL number
> 153.
> 2015-12-11 14:37:56,578 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
> (default task-7) Sent latest CRL to client at 10.51.226.125
> 
> I wonder why and what process wants to look up a CRL with number 0. What is
> CertDistServlet used for? I guess its CDP lookup from the end devices.
> 
> -----Ursprüngliche Nachricht-----
> Von: Tomas Gustavsson [mailto:to...@pr...] 
> Gesendet: Montag, 14. Dezember 2015 18:37
> An: ejb...@li...
> Betreff: Re: [Ejbca-develop] NullPointerException in CRL retrieval
> 
> 
> Hi are you sure the "CN=Root CA,O=MyCompany,C=DE" have CRL available, and
> not just a Sub CA?
> 
> Regards,
> Tomas
> 
> On 2015-12-11 07:32, Ralf Hornik wrote:
>> Hi,
>>
>> i just noticed that there are several exceptions from various clients 
>> in the wildfly log:
>>
>> 2015-12-11 14:36:18,817 DEBUG [org.ejbca.ui.web.RequestHelper] 
>> (default
>> task-31) Setting encoding to default value: UTF-8
>> 2015-12-11 14:36:18,820 INFO
>> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-31) 
>> Error retrieving CRL for issuer 'CN=Root CA,O=MyCompany,C=DE' with CRL
> number 0.
>> 2015-12-11 14:36:18,820 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
>> (default task-31) Error sending latest CRL to 10.51.18.138: :
>> java.lang.NullPointerException
>>
>> Other log entries with CRL number >0 are successfull.
>> The clients are mostly windows PCs. I think they try to lookup the CDP 
>> and want to retrieve the CRL.
>>
>> Any hints why ejbca tries to send a CRL with serial 0? The current CRL 
>> number is 15.
>> Thanks and best regards
>>
>> Ralf Hornik
>> Hosting Consulting Services
>> Abt-Gallus-Str. 23
>> 86609 Donauwörth
>> Tel: +49 906 20430 12
>> Fax: +49 906 20430 15
>> Mobil: +49 151 50721262
>> email: rh...@hc...
>> www: http://www.hcservices.de
>>
>>
>>
>> ----------------------------------------------------------------------
>> --------
>>
>>
>>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
> 
> ----------------------------------------------------------------------------
> --
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 
> 
> 
> ------------------------------------------------------------------------------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

Re: [Ejbca-develop] NullPointerException in CRL retrieval

[Ralf H. <rh...@hc...>]

Hi, yes because there are also successfull retrievals but with serial  > 0:

2015-12-11 14:37:56,573 DEBUG [org.ejbca.ui.web.RequestHelper] (default
task-7) Setting encoding to default value: UTF-8
2015-12-11 14:37:56,576 INFO
[org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-7)
Retrieved CRL from issuer 'CN=Root CA,O=MyCompany,C=DE', with CRL number
153.
2015-12-11 14:37:56,578 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
(default task-7) Sent latest CRL to client at 10.51.226.125

I wonder why and what process wants to look up a CRL with number 0. What is
CertDistServlet used for? I guess its CDP lookup from the end devices.

-----Ursprüngliche Nachricht-----
Von: Tomas Gustavsson [mailto:to...@pr...] 
Gesendet: Montag, 14. Dezember 2015 18:37
An: ejb...@li...
Betreff: Re: [Ejbca-develop] NullPointerException in CRL retrieval


Hi are you sure the "CN=Root CA,O=MyCompany,C=DE" have CRL available, and
not just a Sub CA?

Regards,
Tomas

On 2015-12-11 07:32, Ralf Hornik wrote:
> Hi,
> 
> i just noticed that there are several exceptions from various clients 
> in the wildfly log:
> 
> 2015-12-11 14:36:18,817 DEBUG [org.ejbca.ui.web.RequestHelper] 
> (default
> task-31) Setting encoding to default value: UTF-8
> 2015-12-11 14:36:18,820 INFO
> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-31) 
> Error retrieving CRL for issuer 'CN=Root CA,O=MyCompany,C=DE' with CRL
number 0.
> 2015-12-11 14:36:18,820 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
> (default task-31) Error sending latest CRL to 10.51.18.138: :
> java.lang.NullPointerException
> 
> Other log entries with CRL number >0 are successfull.
> The clients are mostly windows PCs. I think they try to lookup the CDP 
> and want to retrieve the CRL.
> 
> Any hints why ejbca tries to send a CRL with serial 0? The current CRL 
> number is 15.
> Thanks and best regards
> 
> Ralf Hornik
> Hosting Consulting Services
> Abt-Gallus-Str. 23
> 86609 Donauwörth
> Tel: +49 906 20430 12
> Fax: +49 906 20430 15
> Mobil: +49 151 50721262
> email: rh...@hc...
> www: http://www.hcservices.de
> 
> 
> 
> ----------------------------------------------------------------------
> --------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

----------------------------------------------------------------------------
--
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Integrate EMM Air Watch with PKI EJBCA

[Tomas G. <to...@pr...>]

Yes, this has been done.

I'm not sure if it requires SCEP RA mode or not though. We will be
working on an integration guide for EJBCA Enterprise with Airwatch.

Cheers,
Tomas

On 2015-12-15 02:48, nouchi david wrote:
> Hi,
> 
> Does anyone has already integrated PKI EJBCA with EMM AIR WATCH to
> generate and push certificates on smartphones (Android, IOS) using EJBCA
> Web Services (SOAP ?)?
> 
> Thanks in advance for your return
> 
> Regards
>  
> ------------------- 
>  David NOUCHI
> 
> 
> ------------------------------------------------------------------------------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] Integrate EMM Air Watch with PKI EJBCA

[nouchi d. <dno...@ya...>]

Hi,
Does anyone has already integrated PKI EJBCA with EMM AIR WATCH to generate and push certificates on smartphones (Android, IOS) using EJBCA Web Services (SOAP ?)?
Thanks in advance for your return
Regards -------------------  David NOUCHI

Re: [Ejbca-develop] NullPointerException in CRL retrieval

[Tomas G. <to...@pr...>]

Hi are you sure the "CN=Root CA,O=MyCompany,C=DE" have CRL available,
and not just a Sub CA?

Regards,
Tomas

On 2015-12-11 07:32, Ralf Hornik wrote:
> Hi,
> 
> i just noticed that there are several exceptions from various clients in the
> wildfly log:
> 
> 2015-12-11 14:36:18,817 DEBUG [org.ejbca.ui.web.RequestHelper] (default
> task-31) Setting encoding to default value: UTF-8
> 2015-12-11 14:36:18,820 INFO
> [org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-31) Error
> retrieving CRL for issuer 'CN=Root CA,O=MyCompany,C=DE' with CRL number 0.
> 2015-12-11 14:36:18,820 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
> (default task-31) Error sending latest CRL to 10.51.18.138: :
> java.lang.NullPointerException
> 
> Other log entries with CRL number >0 are successfull.
> The clients are mostly windows PCs. I think they try to lookup the CDP and
> want to retrieve the CRL.
> 
> Any hints why ejbca tries to send a CRL with serial 0? The current CRL
> number is 15.
> Thanks and best regards
> 
> Ralf Hornik
> Hosting Consulting Services
> Abt-Gallus-Str. 23
> 86609 Donauwörth
> Tel: +49 906 20430 12
> Fax: +49 906 20430 15
> Mobil: +49 151 50721262
> email: rh...@hc...
> www: http://www.hcservices.de
> 
> 
> 
> ------------------------------------------------------------------------------
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] NullPointerException in CRL retrieval

[Ralf H. <rh...@hc...>]

Hi,

i just noticed that there are several exceptions from various clients in the
wildfly log:

2015-12-11 14:36:18,817 DEBUG [org.ejbca.ui.web.RequestHelper] (default
task-31) Setting encoding to default value: UTF-8
2015-12-11 14:36:18,820 INFO
[org.cesecore.certificates.crl.CrlStoreSessionBean] (default task-31) Error
retrieving CRL for issuer 'CN=Root CA,O=MyCompany,C=DE' with CRL number 0.
2015-12-11 14:36:18,820 DEBUG [org.ejbca.ui.web.pub.CertDistServlet]
(default task-31) Error sending latest CRL to 10.51.18.138: :
java.lang.NullPointerException

Other log entries with CRL number >0 are successfull.
The clients are mostly windows PCs. I think they try to lookup the CDP and
want to retrieve the CRL.

Any hints why ejbca tries to send a CRL with serial 0? The current CRL
number is 15.
Thanks and best regards

Ralf Hornik
Hosting Consulting Services
Abt-Gallus-Str. 23
86609 Donauwörth
Tel: +49 906 20430 12
Fax: +49 906 20430 15
Mobil: +49 151 50721262
email: rh...@hc...
www: http://www.hcservices.de

Re: [Ejbca-develop] EBJCA and Wildfly Install

[Tomas G. <to...@pr...>]

Hi,

"No EJB receiver available..."

Means that EJBCA did not deploy correctly. After the step "ant clean
deployear" you should check the wildfly server.log.

Now I see btw, WildFly 9 does not work with EJBCA 6.3. Unfortunately I
see that this is described in the section about wildfly 8.

So you should use Wildfly 8 until the next release of EJBCA Community,
then wildfly 9 will work as well.

Cheers,
Tomas
Save time and money with an Enterprise support subscription. Please see
www.primekey.se for more information.
https://www.primekey.se/technologies/products-overview/
https://www.primekey.se/service-support/support/


On 2015-12-11 02:58, Phil Daws wrote:
> Hello,
> 
> Am attempting to install EJBCA with Wildfly to learn more about PKI.  I have been following http://ejbca.org/docs/installation.html and so far got Wildfly 9 up and running plus the data source connection to a MariaDB database.
> 
> What I am struggling with now is what to do next ?  I have tried:
> 
> ant clean deployear
> and install
> 
> But once that runs and I enter SuperAdmin password etc it errors with:
> 
> ejbca:initCA:
>      [echo] Initializing CA with 'MYCA' 'CN=MYCA,O=TESTLAB,C=GB' 'soft' <ca.tokenpassword hidden> '2048' 'RSA' '3650' 'null' 'SHA256WithRSA'   -superadmincn 'SuperAdmin'...
>      [java] Exception in thread "main" java.util.ServiceConfigurationError: org.ejbca.ui.cli.infrastructure.command.CliCommandPlugin: Provider org.ejbca.ui.cli.ra.AddEndEntityCommand could not be instantiated
>      [java]     at java.util.ServiceLoader.fail(ServiceLoader.java:224)
>      [java]     at java.util.ServiceLoader.access$100(ServiceLoader.java:181)
>      [java]     at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:377)
>      [java]     at java.util.ServiceLoader$1.next(ServiceLoader.java:445)
>      [java]     at org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<init>(CommandLibrary.java:53)
>      [java]     at org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<clinit>(CommandLibrary.java:38)
>      [java]     at org.ejbca.ui.cli.EjbcaEjbCli.main(EjbcaEjbCli.java:29)
>      [java] Caused by: java.lang.IllegalStateException: EJBCLIENT000025: No EJB receiver available for handling [appName:ejbca, moduleName:cesecore-ejb, distinctName:] combination for invocation context org.jboss.ejb.client.EJBClientInvocationContext@682efa99
>      [java]     at org.jboss.ejb.client.EJBClientContext.requireEJBReceiver(EJBClientContext.java:774)
>      [java]     at org.jboss.ejb.client.ReceiverInterceptor.handleInvocation(ReceiverInterceptor.java:116)
>      [java]     at org.jboss.ejb.client.EJBClientInvocationContext.sendRequest(EJBClientInvocationContext.java:186)
>      [java]     at org.jboss.ejb.client.EJBInvocationHandler.sendRequestWithPossibleRetries(EJBInvocationHandler.java:255)
>      [java]     at org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:200)
>      [java]     at org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:183)
>      [java]     at org.jboss.ejb.client.EJBInvocationHandler.invoke(EJBInvocationHandler.java:146)
>      [java]     at com.sun.proxy.$Proxy0.getCachedConfiguration(Unknown Source)
>      [java]     at org.ejbca.ui.cli.ra.AddEndEntityCommand.<init>(AddEndEntityCommand.java:89)
>      [java]     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>      [java]     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>      [java]     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>      [java]     at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
>      [java]     at java.lang.Class.newInstance(Class.java:383)
>      [java]     at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:373)
>      [java]     ... 4 more
> 
> BUILD FAILED
> 
> What steps have I missed please ?
> 
> Thanks, Phil
> 
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

Re: [Ejbca-develop] EJBCA on WildFly 8 (and 9)

[Tomas G. <to...@pr...>]

Hi,

This message is nothing to worry about. Completely normal.

Regards,
Tomas

On 2015-12-11 02:23, Phil Daws wrote:
> Hello Tomas:
> 
> Am attempting to get EBJCA running on Wildfly 9 but keep receiving this error:
> 
> [java] 0    [main] INFO  org.cesecore.keys.token.CryptoTokenFactory  - Class not found: se.primeKey.caToken.card.PrimeCAToken.
> [java] 1    [main] INFO  org.cesecore.keys.token.CryptoTokenFactory  - Can not register se.primeKey.caToken.card.PrimeCAToken. This is normally not an error.
> 
> Is that anything to worry about ?
> 
> Thanks, Phil
> 
> 
> ----- On 10 Sep, 2015, at 12:02, Tomas Gustavsson to...@pr... wrote:
> 
>> This link should work better.
>>
>> http://ejbca.org/docs/installation.html#WildFly%208
>>
>> Cheers,
>> Tomas
>>
>> On 2015-09-10 12:51, Tomas Gustavsson wrote:
>>>
>>> Hi,
>>>
>>> We have completed the documentation how to run EJBCA on WildFly. Latest
>>> Community should run well on WildFly 8, while running on WildFly 9
>>> requires a small change to build classpath which is in svn trunk.
>>>
>>> http://ejbca.org/docs/installation.html#WildFly 8
>>>
>>> If you see any issues, please report.
>>>
>>> Cheers,
>>> Tomas
>>>
>>> ------------------------------------------------------------------------------
>>> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
>>> Get real-time metrics from all of your servers, apps and tools
>>> in one place.
>>> SourceForge users - Click here to start your Free Trial of Datadog now!
>>> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
>>> _______________________________________________
>>> Ejbca-develop mailing list
>>> Ejb...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>>
>>
>> ------------------------------------------------------------------------------
>> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
>> Get real-time metrics from all of your servers, apps and tools
>> in one place.
>> SourceForge users - Click here to start your Free Trial of Datadog now!
>> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] EBJCA and Wildfly Install

[Phil D. <ux...@sp...>]

Hello,

Am attempting to install EJBCA with Wildfly to learn more about PKI.  I have been following http://ejbca.org/docs/installation.html and so far got Wildfly 9 up and running plus the data source connection to a MariaDB database.

What I am struggling with now is what to do next ?  I have tried:

ant clean deployear
and install

But once that runs and I enter SuperAdmin password etc it errors with:

ejbca:initCA:
     [echo] Initializing CA with 'MYCA' 'CN=MYCA,O=TESTLAB,C=GB' 'soft' <ca.tokenpassword hidden> '2048' 'RSA' '3650' 'null' 'SHA256WithRSA'   -superadmincn 'SuperAdmin'...
     [java] Exception in thread "main" java.util.ServiceConfigurationError: org.ejbca.ui.cli.infrastructure.command.CliCommandPlugin: Provider org.ejbca.ui.cli.ra.AddEndEntityCommand could not be instantiated
     [java]     at java.util.ServiceLoader.fail(ServiceLoader.java:224)
     [java]     at java.util.ServiceLoader.access$100(ServiceLoader.java:181)
     [java]     at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:377)
     [java]     at java.util.ServiceLoader$1.next(ServiceLoader.java:445)
     [java]     at org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<init>(CommandLibrary.java:53)
     [java]     at org.ejbca.ui.cli.infrastructure.library.CommandLibrary.<clinit>(CommandLibrary.java:38)
     [java]     at org.ejbca.ui.cli.EjbcaEjbCli.main(EjbcaEjbCli.java:29)
     [java] Caused by: java.lang.IllegalStateException: EJBCLIENT000025: No EJB receiver available for handling [appName:ejbca, moduleName:cesecore-ejb, distinctName:] combination for invocation context org.jboss.ejb.client.EJBClientInvocationContext@682efa99
     [java]     at org.jboss.ejb.client.EJBClientContext.requireEJBReceiver(EJBClientContext.java:774)
     [java]     at org.jboss.ejb.client.ReceiverInterceptor.handleInvocation(ReceiverInterceptor.java:116)
     [java]     at org.jboss.ejb.client.EJBClientInvocationContext.sendRequest(EJBClientInvocationContext.java:186)
     [java]     at org.jboss.ejb.client.EJBInvocationHandler.sendRequestWithPossibleRetries(EJBInvocationHandler.java:255)
     [java]     at org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:200)
     [java]     at org.jboss.ejb.client.EJBInvocationHandler.doInvoke(EJBInvocationHandler.java:183)
     [java]     at org.jboss.ejb.client.EJBInvocationHandler.invoke(EJBInvocationHandler.java:146)
     [java]     at com.sun.proxy.$Proxy0.getCachedConfiguration(Unknown Source)
     [java]     at org.ejbca.ui.cli.ra.AddEndEntityCommand.<init>(AddEndEntityCommand.java:89)
     [java]     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
     [java]     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
     [java]     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
     [java]     at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
     [java]     at java.lang.Class.newInstance(Class.java:383)
     [java]     at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:373)
     [java]     ... 4 more

BUILD FAILED

What steps have I missed please ?

Thanks, Phil

Re: [Ejbca-develop] EJBCA on WildFly 8 (and 9)

[Phil D. <ux...@sp...>]

Hello Tomas:

Am attempting to get EBJCA running on Wildfly 9 but keep receiving this error:

[java] 0    [main] INFO  org.cesecore.keys.token.CryptoTokenFactory  - Class not found: se.primeKey.caToken.card.PrimeCAToken.
[java] 1    [main] INFO  org.cesecore.keys.token.CryptoTokenFactory  - Can not register se.primeKey.caToken.card.PrimeCAToken. This is normally not an error.

Is that anything to worry about ?

Thanks, Phil


----- On 10 Sep, 2015, at 12:02, Tomas Gustavsson to...@pr... wrote:

> This link should work better.
> 
> http://ejbca.org/docs/installation.html#WildFly%208
> 
> Cheers,
> Tomas
> 
> On 2015-09-10 12:51, Tomas Gustavsson wrote:
>>
>> Hi,
>>
>> We have completed the documentation how to run EJBCA on WildFly. Latest
>> Community should run well on WildFly 8, while running on WildFly 9
>> requires a small change to build classpath which is in svn trunk.
>>
>> http://ejbca.org/docs/installation.html#WildFly 8
>>
>> If you see any issues, please report.
>>
>> Cheers,
>> Tomas
>>
>> ------------------------------------------------------------------------------
>> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
>> Get real-time metrics from all of your servers, apps and tools
>> in one place.
>> SourceForge users - Click here to start your Free Trial of Datadog now!
>> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
> 
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools
> in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Adding static content to ejbca/doc in ejbca 6.3.1.1.CE

[Ralf H. <rh...@hc...>]

Ok I got it working using the following "hack"

cd $EJBCA_HOME/dist
zip -0 doc.war static.html
zip -0 ejbca.ear doc.war
cd .. && and deployear

If anyone else has a better idea, just drop it here :-)
Regards

Ralf

-----Ursprüngliche Nachricht-----
Von: Ralf Hornik [mailto:rh...@hc...]
Gesendet: Donnerstag, 19. November 2015 11:53
An: ejb...@li...
Betreff: Re: [Ejbca-develop] Adding static content to ejbca/doc in ejbca 6.3.1.1.CE

Unfortunately not.

"Ant build" also removes any temp content, compiles and buildes the ejbca.ear.
"Ant deployear" only copies the file to the deployment folder of JBoss.

It seems i will have to patch the dist/ejbca.ear afterwards

-----Ursprüngliche Nachricht-----
Von: Tomas Gustavsson [mailto:to...@pr...]
Gesendet: Donnerstag, 19. November 2015 10:40
An: ejb...@li...
Betreff: Re: [Ejbca-develop] Adding static content to ejbca/doc in ejbca 6.3.1.1.CE


Did you try "ant build deployear"?

/T

On 2015-11-18 17:28, Ralf Hornik wrote:
> Hello,
>
> we use a specific info site under https://server/ejbca/doc With
> version 4 it was possible to add this content in
"$EJBCA_HOME/tmp/htdocs/info.html" followed by an "ant deploy".
> But since version 6 this seems to be not working any more.
>
> With "ant deployear" the file is not added to the "ejbca.ear" and removing
the old "dist/ejbca.ear" leads to a complete cleanup that removes anything
before building the new file.
> How can we add persistent static content (independend from the EJBCA
Source documentation) to the "/doc" directive?
>
> Thanks and kind regards
>
> Ralf
>
>
> ----------------------------------------------------------------------
> -------- _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

----------------------------------------------------------------------------
--
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Adding static content to ejbca/doc in ejbca 6.3.1.1.CE

[Ralf H. <rh...@hc...>]

Unfortunately not.

"Ant build" also removes any temp content, compiles and buildes the
ejbca.ear.
"Ant deployear" only copies the file to the deployment folder of JBoss.

It seems i will have to patch the dist/ejbca.ear afterwards

-----Ursprüngliche Nachricht-----
Von: Tomas Gustavsson [mailto:to...@pr...] 
Gesendet: Donnerstag, 19. November 2015 10:40
An: ejb...@li...
Betreff: Re: [Ejbca-develop] Adding static content to ejbca/doc in ejbca
6.3.1.1.CE


Did you try "ant build deployear"?

/T

On 2015-11-18 17:28, Ralf Hornik wrote:
> Hello,
> 
> we use a specific info site under https://server/ejbca/doc With 
> version 4 it was possible to add this content in
"$EJBCA_HOME/tmp/htdocs/info.html" followed by an "ant deploy".
> But since version 6 this seems to be not working any more.
> 
> With "ant deployear" the file is not added to the "ejbca.ear" and removing
the old "dist/ejbca.ear" leads to a complete cleanup that removes anything
before building the new file.
> How can we add persistent static content (independend from the EJBCA
Source documentation) to the "/doc" directive?
> 
> Thanks and kind regards
> 
> Ralf
> 
> 
> ----------------------------------------------------------------------
> -------- _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

----------------------------------------------------------------------------
--
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop