ejbca-develop — Development discussions

Re: [Ejbca-develop] Clustering mode: nodenames discovery

[Tomas G. <to...@pr...>]

Hi Bruno,

You are correct in most of your analysis. EJBCA uses 
"InetAddress.getLocalHost" to get the local hostname. What this returns 
depends on what is in the host file of course.

 > - is this behavior may considered as a bug? (using nodename rather
 >    binding IP name).

No, it is deliberate. Hostname is much more flexible, and often more 
correct than ip address. EJBCA does not know which IP JBoss binds to, 
and it can change at any time. Most hosts have multiple IPs, and EJBCA 
can not know which are used for what. With a hostname the cluster nodes 
can have each others hostnames in the local hosts file if needed. This 
can point to anywhere so it is configurable by the admins.

You can simply add the correct ip addresses in the cluster nodes's local 
hosts files.

One improvement that I could think of would be if you could override the 
detected hostname by a configuration option. Than you could use other 
hostnames than the real ones, pointing to other ip-adresses?

By the way, if JBoss is behind an apache proxy, it does not matter what 
IP JBoss binds to, since it will be apache that accepts the connection. 
So it is actually the IPs/hostnames that apache binds to that are relevant.

 > - can you confirm if I remove by hand the node in the nodelist, each
 >    time I'll start EJBCA on a node, it will add the new member? (since
 >    EJBCA will check if the hostname exists)

Yes this is correct.

 > - more or less the same question when JBoss are not directly reachable
 >    but only through an Apache (on a different nodename.. :)

If "nodename" is not reachable from one cluster node to the other, even 
if you add the correct ip address in the local hosts file, you can not 
use the global "clear cache" button. Very simple :-) If you need to 
clear caches when the cluster nodes can not talk to each other, you need 
to clear the cache individually on all nodes.

An error when clicking the button simply means that the cache was not 
cleared on that host, and you have to clear it manually. There is a CLI 
for clearing caches as well, so you can easily script it.

Cheers,
Tomas

On 07/13/2012 04:19 PM, Bruno Bonfils wrote:
> Hi folks,
>
> I'm wondering how EJBCA determines the "nodename" in a cluster
> environnement. As far as I understand/remember the code, EJBCA use the
> hostname of the server, which may we wrong.
>
> My environnement is the following:
> 	2 JBoss, each one use a dedicated IP address (given as -b when
> starting jboss)
> 	Each JBoss is protected by an Apache acting as reverse proxy
>
> When I start EJBCA, if I displays the list of nodes I can see the list
> of hostnames of servere where EJBCA is running. And when I click on
> "Clear all caches" button, I had a "Connexion refused" exception.
> Indeed, the code is:
>
> "String nodeip = InetAddress.getByName(nodename).getHostAddress();"
>
> But, since I use a dedicated IP for JBoss, EJBCA is not reachable on the
> nodename's primary address.
>
> So my questions are:
>
> - is this behavior may considered as a bug? (using nodename rather
>    binding IP name).
> - can you confirm if I remove by hand the node in the nodelist, each
>    time I'll start EJBCA on a node, it will add the new member? (since
>    EJBCA will check if the hostname exists)
> - more or less the same question when JBoss are not directly reachable
>    but only through an Apache (on a different nodename.. :)
>
> Best regards
>

[Ejbca-develop] Clustering mode: nodenames discovery

[Bruno B. <as...@as...>]

Hi folks,

I'm wondering how EJBCA determines the "nodename" in a cluster
environnement. As far as I understand/remember the code, EJBCA use the
hostname of the server, which may we wrong.

My environnement is the following:
	2 JBoss, each one use a dedicated IP address (given as -b when
starting jboss)
	Each JBoss is protected by an Apache acting as reverse proxy

When I start EJBCA, if I displays the list of nodes I can see the list
of hostnames of servere where EJBCA is running. And when I click on
"Clear all caches" button, I had a "Connexion refused" exception.
Indeed, the code is:

"String nodeip = InetAddress.getByName(nodename).getHostAddress();"

But, since I use a dedicated IP for JBoss, EJBCA is not reachable on the
nodename's primary address.

So my questions are:

- is this behavior may considered as a bug? (using nodename rather
  binding IP name). 
- can you confirm if I remove by hand the node in the nodelist, each
  time I'll start EJBCA on a node, it will add the new member? (since
  EJBCA will check if the hostname exists)
- more or less the same question when JBoss are not directly reachable
  but only through an Apache (on a different nodename.. :)

Best regards

-- 
http://asyd.net/home/    - Home Page
http://netvibes.com/asyd - Portal

Re: [Ejbca-develop] rough estimation

[Martin P. <ma...@ma...>]

Hello,

On Thu, Jul 12, 2012 at 7:18 PM, Hans Witvliet <hw...@a-...> wrote:
> So, to summarize, if a small org or medium company needs to start
> enrolling certificates & smartcards, can anything been said about
> - amount of time for implementing
> - cost estimation

It all depends on the actual requirements for "the PKI" - the
platforms and applications in use, necessary integration, existing
systems (IAM or similar), future administration capabilities etc etc

For a company with few hundred (~200..500) people, with "standard
requirements" of wokrstation login, online ssl auth and e-mail
signatures with s/mime, I might guesstimate it to take (with open
source software such as EJBCA) somewhere around 3..6 months and
comparable cost for a small team (3..5) + hardware and software
licenses, if any (in a Windows world, this might be relevant)

This would also work if you got your organization CA certificate
signed by some "trusted third party", be it a commercial CA or some
actually^H^H^H^H^H^Hmore trusted third party.

Maybe this helps.


Martin

[Ejbca-develop] Disable all logging to DB

[Arshad N. <ars...@st...>]

Hello,

The "Maximizing Performance" section of the Admin Guide has this line:

"Disable logging to database in log.properties, only use Log4jLogDevice. 
This removes a database insert and gives a big boost."

Additionally, the log.properties file in the $EJBCA_HOME/conf indicates:

# Internal EJBCA logging device that writes to the database. See 
logdevices/oldlog.properties.sample for more information.
OldLogDevice=org.ejbca.core.model.log.OldLogDeviceFactory;logdevices/oldlog.properties

This seems to imply that by commenting the OldLogDevice line in this
file and redeploying the EAR, one can turn off DB-logging.  However,
this does not seem to work.

Can someone shed some light on how to turn off DB logging completely?

I am assuming that the server.log file is capturing all events that
might normally have been logged in the DB.  If this is not true, it
will be helpful to know what does NOT get logged if DB-logging is
turned off.

Thank you.

Arshad Noor
StrongAuth, Inc.

Re: [Ejbca-develop] rough estimation

[Hans W. <hw...@a-...>]

On Thu, 2012-07-12 at 10:27 +0200, Andreas Bürki wrote:
> Hi Hans
> 
> How do you define:
> > 1) fully implemented official PKI
> 
> more specific, how do you define
> 
> official?
> 
Hi Andreas,

perhaps i was a bit too brief there...

I know that there are companies/organisation that have taken the lengthy
trouble and have certificates signed by commercial CA's. When employees
are hired/fired, certificates are created or revoked, etc etc etc


So what we see is at one hand, there are companies that start looking
for the possibilities that PKI offer, but have nothing implemented
_yet_).

And on the other hand, small organisations that do not want/need a
trusted third party (only two parties involved) but want to use the
possibilities that asymetric keys and certificates offer. 
Obviously, the needs of an airplane manufacturer are somewhat different
from that of a table-tennis-organisation ;-) But even there, there must
be a connection between the management of new/leaving members and
revocation of their certificate.

So, to summarize, if a small org or medium company needs to start
enrolling certificates & smartcards, can anything been said about 
- amount of time for implementing
- cost estimation

I have no intention of being part of it, but if i say to a potential
customer:
"all your members/workers need a smartcard holding certificates" 
and 
"your organisation must take care of issuing and revoking",
I can expect the questions that if they don't have that, what it will
cost them and how long it will take....

Hence my question

Hans

Re: [Ejbca-develop] rough estimation

[Andreas B. <ab...@an...>]

Hi Hans

How do you define:
> 1) fully implemented official PKI

more specific, how do you define

official?


Cheers, Andreas


Am 12.07.2012 09:53, schrieb Hans Witvliet:
> Hi all,
> 
> Perhaps this messages may seem O.T. from a technical point of view, but
> i'll guess there are some people around here that have experience with
> the organisational aspects of deploying PKI.
> 
> Short intro:
> For my employer our team made a product that heaviliy relies on a good
> working PKI environment. It looks like a success: even during the pilot
> phase, over 9500 co-workers volunteered (we have about 60,000 people)
> 
> Last couple of months we got questions from other departments and
> companies about our product. So we are widen our horizon.
> As said, it is heavily based upon a working PKI, but not every company
> has that up-and-running.
> 
>>From my POV, there are two options:
> 1) fully implemented official PKI
> 2) very small (self signed) environment for cards & certificates
> 
> We were wondering what can be expected regarding
> - timescale
> - costs
> for doing such implementation.
> 
>>From what i learned so far, the technical part is minuscule compared
> with the organisational overhead. (i presume it's more like EAL4+
> effort)
> Obviously our team is way to small to implement full PKI, but is it
> possible to give an indications?
> For instance companies/organisation with 100-1000 people or 5,000-50,000
> people?
> 
> Hans
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

-- 
Andreas Bürki

E-Mail:
ab...@an...
Zertifikat - SHA1-Fingerprint:
54:99:02:5F:60:CE:7A:27:0E:73:79:24:CA:C7:A0:CC:60:39:05:9F

[Ejbca-develop] rough estimation

[Hans W. <hw...@a-...>]

Hi all,

Perhaps this messages may seem O.T. from a technical point of view, but
i'll guess there are some people around here that have experience with
the organisational aspects of deploying PKI.

Short intro:
For my employer our team made a product that heaviliy relies on a good
working PKI environment. It looks like a success: even during the pilot
phase, over 9500 co-workers volunteered (we have about 60,000 people)

Last couple of months we got questions from other departments and
companies about our product. So we are widen our horizon.
As said, it is heavily based upon a working PKI, but not every company
has that up-and-running.

>From my POV, there are two options:
1) fully implemented official PKI
2) very small (self signed) environment for cards & certificates

We were wondering what can be expected regarding
- timescale
- costs
for doing such implementation.

>From what i learned so far, the technical part is minuscule compared
with the organisational overhead. (i presume it's more like EAL4+
effort)
Obviously our team is way to small to implement full PKI, but is it
possible to give an indications?
For instance companies/organisation with 100-1000 people or 5,000-50,000
people?

Hans

[Ejbca-develop] EJBCA 4.0.11 released

[Tomas G. <to...@pr...>]

Dear community,

We have just released a new version of EJBCA, 4.0.11.

This is a maintenance release containing a few new features, GUI 
improvements and support for Japanese.

* Noteworthy changes:
- Support for Japanese in the admin GUI.
- Possibility to use custom revocation dates.
- Possibility to use aliases in RFC4387 CRL download links.
- Fixed support for special characters in filenames in export profiles 
cli command.
- Admin GUI improvements for looks and consistency.

You can read the full changelog at https://jira.primekey.se/browse/ECA

Regards,
The PrimeKey EJBCA Team

Re: [Ejbca-develop] Can't use external OCSPResponder

[tungdt.bk <tun...@gm...>]

Duonguno <duongmn@...> writes:

> 
> 
> Hi.
> Thankyou very much. I fixed my error.
> 

Hi Duong,
I have a same error. How did you fix it?

[Ejbca-develop] Integrating a properietary CA with EJBCA > RA Module for SCEP

[Muhammed W. K. <mw...@ma...>]

Hi Guys,

 I have been requested to assess the possibility of using another CA (not EJBCA) to issue certs for devices which would communicate with the RA (yet to develop) using SCEP. Itts not because EJBCA is no good, its because the CA I am looking to integrate also provide other services like digital signature creation, verification etc hence it makes one stop for clients to generate end user certificates, signing, device certificates etc. 

 I know EJBCA has implemented this but can I plug the properietary CA and using the RA API to poll the EJBCA RA and get the certificates issued. I have read this: http://www.ejbca.org/externalra.html  but its not crystal clear whether this is possible. If it is what clear interfaces I have to implement? If not then this means that the properietary CA needs to implement its own RA which supports SCEP which I want to avoid.

 Regards,
 wahaj

Re: [Ejbca-develop] which one should sign EJBCA or HSM?

[Amir M. m. <dar...@gm...>]

Voila ….problem solved. I install EJBCA_4_0_3 connected to a ProtectServer
Gold HSM (with recommended and reasonable attributes as mentioned in most
new version of Admin Guide) on my CentOS-5.5 machine.



Just in older versions, ejbca explicitly recommended to set CKA_EXTRACTABLE
= true
http://ejbca.org/older_releases/ejbca_3_9/htdocs/manual.html#SafeNet%20ProtectServer


At the other side, as Tomas said ,ProtectServer Gold HSM has a bug in
generating exportable keys.I tested it and unfortunately it's true.

So now it seems that it’s time to migrate to a newer version of ejbca ;)


Thank you all for your attention

Regards

Dariush


2012/6/5 Tomas Gustavsson <to...@pr...>

>
> Yes, fortunately Amirs analysis in not completely correct :-)
>
> This is what happens:
>
> 1. Amir, you are probably using an old version of EJBCA to generate
> keys, that does not explicitly set all flags. And you do not use a
> pkcs11 configuration file (described in older documentation, but not
> needed anymore).
>
> 2. ProtectServer Gold has a bug so that it generates exportable keys by
> default. Other HSMs do not do this.
>
> 3. Due to this bug in ProtectServer later versions of EJBCA even refuses
> to use exportable keys, in order to protect the user of EJBCA.
>
> So, Amir, you can either set the PKCS11 parameters you want (there are
> good exact samples in the documentation) or you can upgrade your EJBCA
> clientToolBox to a later version that does it for you.
>
> The feature to refuse to use exportable keys was actually introduced
> already in EJBCA 3.10.5.
>
> https://jira.primekey.se/browse/ECA-1823?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel
>
> So my best guess is that you generated your keys with a version of
> clientToolBox that is older than that?
>
> Regards,
> Tomas
>
> On 06/05/2012 02:21 PM, Tham Wickenberg wrote:
> > Hello,
> >
> > The following are the default attributes when creating keys with
> > EJBCA/ClientToolBox:
> >
> > attributes(*, *, *) = {
> >     CKA_TOKEN = true
> > }
> > attributes(*, CKO_PUBLIC_KEY, *) = {
> >     CKA_ENCRYPT = true
> >     CKA_VERIFY = true
> >     CKA_WRAP = true
> > }
> > attributes(*, CKO_PRIVATE_KEY, *) = {
> >     CKA_PRIVATE = true
> >     CKA_SENSITIVE = true
> >     CKA_EXTRACTABLE = false
> >     CKA_DECRYPT = true
> >     CKA_SIGN = true
> >     CKA_UNWRAP = true
> > }");
> >
> >
> > This is what you will get if you do not provide the properties yourself.
> >
> > It does sound strange that you would get anything else, what is the
> > exact command that you have run and what version of EJBCA where you
> using?
> >
> > Kind regards,
> > Tham Wickenberg
> > PrimeKey Tech Support
> >
> > On 6/5/12 2:15 PM, ejbca-support wrote:
> >> On 2012-06-05 13:45, Amir Masoud mojallal wrote:
> >>> Hi
> >>>
> >>> According to me, in EJBCA source code there is a getPrivateKey(int
> >>> purpose) method (located in
> >>> org\ejbca\core\model\ca\catoken\ICAToken.java Interface) that is
> >>> implemented in other concrete classed (BaseCAToken.java and
> >>> PKCS11CAToken.java) and lets EJBCA to fetch private key from HSM then
> >>> EJBCA itself does signing/verifying (Am I right?).These all are
> >>> because in default installation, private keys in HSM are generated
> >>> with both “exportable” and “modifiable” flags set to “ON”!!! . (if the
> >>> key pair be generated by issuing  “ejbcaClientToolBox.sh” command as
> >>> mentioned in Admin Guide doc , Hardware Security Module have section)
> >>> But from security point of view a private key must not leave the HSM
> >>> ,otherwise it has some security risks .I can't understand the
> >>> intention of doing so,instead of sending things to HSM and letting HSM
> >>> itself signs/verifies the things .any idea please?
> >>> My experience is on Safe Net Protect Server HSM.
> >> Hi Amir,
> >>
> >> That is not how it works.   The signatures are indeed performed in the
> >> HSM.  That keys would be exportable in the default installation sounds
> >> very strange; where did you get this information?
> >>
> >> Regards
> >> Anders
> >> tech support
> >>
> >>> Regards
> >>> Dariush
> >>>
> >>>
> ------------------------------------------------------------------------------
> >>> Live Security Virtual Conference
> >>> Exclusive live event will cover all the ways today's security and
> >>> threat landscape has changed and how IT managers can respond.
> Discussions
> >>> will include endpoint security, mobile security and the latest in
> malware
> >>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> >>> _______________________________________________
> >>> Ejbca-develop mailing list
> >>> Ejb...@li...
> >>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >>
> >>
> ------------------------------------------------------------------------------
> >> Live Security Virtual Conference
> >> Exclusive live event will cover all the ways today's security and
> >> threat landscape has changed and how IT managers can respond.
> Discussions
> >> will include endpoint security, mobile security and the latest in
> malware
> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> >> _______________________________________________
> >> Ejbca-develop mailing list
> >> Ejb...@li...
> >> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
> >
> >
> ------------------------------------------------------------------------------
> > Live Security Virtual Conference
> > Exclusive live event will cover all the ways today's security and
> > threat landscape has changed and how IT managers can respond. Discussions
> > will include endpoint security, mobile security and the latest in malware
> > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] which one should sign EJBCA or HSM?

[Tomas G. <to...@pr...>]

Yes, fortunately Amirs analysis in not completely correct :-)

This is what happens:

1. Amir, you are probably using an old version of EJBCA to generate 
keys, that does not explicitly set all flags. And you do not use a 
pkcs11 configuration file (described in older documentation, but not 
needed anymore).

2. ProtectServer Gold has a bug so that it generates exportable keys by 
default. Other HSMs do not do this.

3. Due to this bug in ProtectServer later versions of EJBCA even refuses 
to use exportable keys, in order to protect the user of EJBCA.

So, Amir, you can either set the PKCS11 parameters you want (there are 
good exact samples in the documentation) or you can upgrade your EJBCA 
clientToolBox to a later version that does it for you.

The feature to refuse to use exportable keys was actually introduced 
already in EJBCA 3.10.5. 
https://jira.primekey.se/browse/ECA-1823?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel

So my best guess is that you generated your keys with a version of 
clientToolBox that is older than that?

Regards,
Tomas

On 06/05/2012 02:21 PM, Tham Wickenberg wrote:
> Hello,
>
> The following are the default attributes when creating keys with
> EJBCA/ClientToolBox:
>
> attributes(*, *, *) = {
>     CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>     CKA_ENCRYPT = true
>     CKA_VERIFY = true
>     CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>     CKA_PRIVATE = true
>     CKA_SENSITIVE = true
>     CKA_EXTRACTABLE = false
>     CKA_DECRYPT = true
>     CKA_SIGN = true
>     CKA_UNWRAP = true
> }");
>
>
> This is what you will get if you do not provide the properties yourself.
>
> It does sound strange that you would get anything else, what is the
> exact command that you have run and what version of EJBCA where you using?
>
> Kind regards,
> Tham Wickenberg
> PrimeKey Tech Support
>
> On 6/5/12 2:15 PM, ejbca-support wrote:
>> On 2012-06-05 13:45, Amir Masoud mojallal wrote:
>>> Hi
>>>
>>> According to me, in EJBCA source code there is a getPrivateKey(int
>>> purpose) method (located in
>>> org\ejbca\core\model\ca\catoken\ICAToken.java Interface) that is
>>> implemented in other concrete classed (BaseCAToken.java and
>>> PKCS11CAToken.java) and lets EJBCA to fetch private key from HSM then
>>> EJBCA itself does signing/verifying (Am I right?).These all are
>>> because in default installation, private keys in HSM are generated
>>> with both “exportable” and “modifiable” flags set to “ON”!!! . (if the
>>> key pair be generated by issuing  “ejbcaClientToolBox.sh” command as
>>> mentioned in Admin Guide doc , Hardware Security Module have section)
>>> But from security point of view a private key must not leave the HSM
>>> ,otherwise it has some security risks .I can't understand the
>>> intention of doing so,instead of sending things to HSM and letting HSM
>>> itself signs/verifies the things .any idea please?
>>> My experience is on Safe Net Protect Server HSM.
>> Hi Amir,
>>
>> That is not how it works.   The signatures are indeed performed in the
>> HSM.  That keys would be exportable in the default installation sounds
>> very strange; where did you get this information?
>>
>> Regards
>> Anders
>> tech support
>>
>>> Regards
>>> Dariush
>>>
>>> ------------------------------------------------------------------------------
>>> Live Security Virtual Conference
>>> Exclusive live event will cover all the ways today's security and
>>> threat landscape has changed and how IT managers can respond. Discussions
>>> will include endpoint security, mobile security and the latest in malware
>>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>>> _______________________________________________
>>> Ejbca-develop mailing list
>>> Ejb...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] which one should sign EJBCA or HSM?

[Tham W. <ejb...@pr...>]

Hello,

The following are the default attributes when creating keys with 
EJBCA/ClientToolBox:

attributes(*, *, *) = {
   CKA_TOKEN = true
}
attributes(*, CKO_PUBLIC_KEY, *) = {
   CKA_ENCRYPT = true
   CKA_VERIFY = true
   CKA_WRAP = true
}
attributes(*, CKO_PRIVATE_KEY, *) = {
   CKA_PRIVATE = true
   CKA_SENSITIVE = true
   CKA_EXTRACTABLE = false
   CKA_DECRYPT = true
   CKA_SIGN = true
   CKA_UNWRAP = true
}");


This is what you will get if you do not provide the properties yourself.

It does sound strange that you would get anything else, what is the 
exact command that you have run and what version of EJBCA where you using?

Kind regards,
Tham Wickenberg
PrimeKey Tech Support

On 6/5/12 2:15 PM, ejbca-support wrote:
> On 2012-06-05 13:45, Amir Masoud mojallal wrote:
>> Hi
>>
>> According to me, in EJBCA source code there is a getPrivateKey(int
>> purpose) method (located in
>> org\ejbca\core\model\ca\catoken\ICAToken.java Interface) that is
>> implemented in other concrete classed (BaseCAToken.java and
>> PKCS11CAToken.java) and lets EJBCA to fetch private key from HSM then
>> EJBCA itself does signing/verifying (Am I right?).These all are
>> because in default installation, private keys in HSM are generated
>> with both “exportable” and “modifiable” flags set to “ON”!!! . (if the
>> key pair be generated by issuing  “ejbcaClientToolBox.sh” command as
>> mentioned in Admin Guide doc , Hardware Security Module have section)
>> But from security point of view a private key must not leave the HSM
>> ,otherwise it has some security risks .I can't understand the
>> intention of doing so,instead of sending things to HSM and letting HSM
>> itself signs/verifies the things .any idea please?
>> My experience is on Safe Net Protect Server HSM.
> Hi Amir,
>
> That is not how it works.   The signatures are indeed performed in the
> HSM.  That keys would be exportable in the default installation sounds
> very strange; where did you get this information?
>
> Regards
> Anders
> tech support
>
>> Regards
>> Dariush
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] which one should sign EJBCA or HSM?

[ejbca-support <ejb...@pr...>]

On 2012-06-05 13:45, Amir Masoud mojallal wrote:
> Hi
> 
> According to me, in EJBCA source code there is a getPrivateKey(int
> purpose) method (located in
> org\ejbca\core\model\ca\catoken\ICAToken.java Interface) that is
> implemented in other concrete classed (BaseCAToken.java and
> PKCS11CAToken.java) and lets EJBCA to fetch private key from HSM then
> EJBCA itself does signing/verifying (Am I right?).These all are
> because in default installation, private keys in HSM are generated
> with both “exportable” and “modifiable” flags set to “ON”!!! . (if the
> key pair be generated by issuing  “ejbcaClientToolBox.sh” command as
> mentioned in Admin Guide doc , Hardware Security Module have section)
> But from security point of view a private key must not leave the HSM
> ,otherwise it has some security risks .I can't understand the
> intention of doing so,instead of sending things to HSM and letting HSM
> itself signs/verifies the things .any idea please?
> My experience is on Safe Net Protect Server HSM.

Hi Amir,

That is not how it works.   The signatures are indeed performed in the
HSM.  That keys would be exportable in the default installation sounds
very strange; where did you get this information?

Regards
Anders
tech support

> 
> Regards
> Dariush
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

[Ejbca-develop] which one should sign EJBCA or HSM?

[Amir M. m. <dar...@gm...>]

Hi

According to me, in EJBCA source code there is a getPrivateKey(int
purpose) method (located in
org\ejbca\core\model\ca\catoken\ICAToken.java Interface) that is
implemented in other concrete classed (BaseCAToken.java and
PKCS11CAToken.java) and lets EJBCA to fetch private key from HSM then
EJBCA itself does signing/verifying (Am I right?).These all are
because in default installation, private keys in HSM are generated
with both “exportable” and “modifiable” flags set to “ON”!!! . (if the
key pair be generated by issuing  “ejbcaClientToolBox.sh” command as
mentioned in Admin Guide doc , Hardware Security Module have section)
But from security point of view a private key must not leave the HSM
,otherwise it has some security risks .I can't understand the
intention of doing so,instead of sending things to HSM and letting HSM
itself signs/verifies the things .any idea please?
My experience is on Safe Net Protect Server HSM.

Regards
Dariush

Re: [Ejbca-develop] auto enrolment ExtRA

[ejbca-support <ejb...@pr...>]

On 2012-06-04 21:19, Amir Masoud mojallal wrote:
> Hi
> 
> As I know about EJBCA it should be created an end entity in CA before
> issuing its associated certificate in ExtRA side.
> But how can I enrol for a new certificate in ExtrRa side without any
> need to predefine an end entity in CA?Are the solutions limit to use
> one of SCEP or CMP?I think about an auto enrolment ExtRA page ;) does
> it exist?

CMP ca do exactly what you want, creating users and certificates
in one operation.  CMP is though mainly used for card management
systems.

If you rather want a web application you will need to do some programming
or scripting since there should be some way of authenticating the user
before generating a certificate.

Cheers,
Anders
tech support

> 
> Regard
> Dariush
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

[Ejbca-develop] auto enrolment ExtRA

[Amir M. m. <dar...@gm...>]

Hi

As I know about EJBCA it should be created an end entity in CA before
issuing its associated certificate in ExtRA side.
But how can I enrol for a new certificate in ExtrRa side without any
need to predefine an end entity in CA?Are the solutions limit to use
one of SCEP or CMP?I think about an auto enrolment ExtRA page ;) does
it exist?

Regard
Dariush

[Ejbca-develop] Open EJBCA Training in California, USA

[Tomas G. <to...@pr...>]

Hi,

I would like to give you information that we are holding an EJBCA 
training course in San Mateo, California, USA on the 9-12 July.

If interested you can find more information, and other training 
dates/places, at http://www.primekey.se/Services/Training/Open+schedule/.

Regards,
Tomas Gustavsson
PrimeKey Solutions AB

Re: [Ejbca-develop] Signing by HSM

[ejbca-support <ejb...@pr...>]

On 2012-06-01 19:55, Amir Masoud mojallal wrote:
> I've installed ejbca_4_0_3 and configured it to connect to some HSM
> indeed SafeNet ProtectServer.But the CA uses the pair keys created on
> the HSM just to sign its own certificate at install time-I think
> so-but not other's certificates that the CA issues after
> installation!!! Interesting is that I can issue a client certificate
> after disabling the NIC on CA's machine!!!
> I want to  issue the certificates be signed by HSM directly.help me please.

Hi,
Could you provide a part of the log so we can see what kind
of error messages you get?

Regards,
Anders
tech support


> 
> thank you in advance
> Dariush
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

[Ejbca-develop] Signing by HSM

[Amir M. m. <dar...@gm...>]

I've installed ejbca_4_0_3 and configured it to connect to some HSM
indeed SafeNet ProtectServer.But the CA uses the pair keys created on
the HSM just to sign its own certificate at install time-I think
so-but not other's certificates that the CA issues after
installation!!! Interesting is that I can issue a client certificate
after disabling the NIC on CA's machine!!!
I want to  issue the certificates be signed by HSM directly.help me please.

thank you in advance
Dariush

[Ejbca-develop] MobileID open source android app integrated with EJBCA

[Tomas G. <to...@pr...>]

MobileID is a open source new Android app for signatures and encryption.
It is still a beta version, but I though it might be interesting to 
know. It has been integrated with EJBCA so you can get a certificate easily.
Development and further integration will continue...

http://www.mobile-id.org/

http://www.primekey.se/News/All+Releases/Release+detail//Mobile_ID_client_from_Nerd_integrated_with_EJBCA_PKI_from_PrimeKey.cid3167

Cheers,
Tomas

[Ejbca-develop] EJBCA 4.0.11 in preparation

[Tomas G. <to...@pr...>]

Hi,

I have just finished QA for EJBCA 4.0.11, to be released next week. If 
anyone wants to beta test before the release, you can get it from svn,
https://svn.cesecore.eu/svn/ejbca/branches/Branch_4_0/ejbca/

Notable changes are translation of admin GUI to Japaneese (courtesy of 
OGIS-RI, Japan) and firther admin GUI improvements (courtesy of Linagora).

Regards,
Tomas

[Ejbca-develop] Open EJBCA trainings in Sweden and USA

[Tomas G. <to...@pr...>]

Hi Community,

For those that might be interested.
PrimeKey is setting up open EJBCA training courses in Sweden and USA.

For the schedule from June to November, visit:
http://www.primekey.se/Services/Training/Open+schedule/

Cheers,
Tomas

Re: [Ejbca-develop] nameConstraints extension support in EJBCA

[Tomas G. <to...@pr...>]

Arshad, this time I believe in my interpretation :-). 
Since the usage of name constraints have been actualized with the latest SSL hacks. The future usage of name constraints is layed out in a spec by Mozilla. This is the spec public CAs will have to adhere to. The spec specifies how clients should interpret this. 

You can never have an extension like this for the sole purpose of issuing CA software. Since the purpose is to prevent rogue CAs, who can do whatever they want, the final verdict is in the path validation algorithm in the client.

If you read the path validation algorithm part in rfc5280, I think you will find the name constraints there, during path validation.

(I am mobile so I cant give references to the Mozilla spec or rfc right now).

The matching of altnames etc Is a completely other, unrelated thing.
The purpose of name constraints is that clients should not accept a www.google.com certificate issued by the (hacked) strongauth ca, although that ca is certified by VeriSign, and issues a correct certificate with the correct distinguished name and altnames. 
The path validation tells the client that the strongauth ca is only permitted to issue certificates with altnames and DNs from the strongauth domain.

Cheers,
Tomas

Arshad Noor <ars...@st...> skrev:

Hi Tomas,

Thanks for your response; I will look into the Custom Extensions
section of the EJBCA documentation and see how easy/difficult it is
to include the constraint in CA certificates.

However, I believe you and I may have a misunderstanding about how
the nameConstraints extension is used - although this is not the first
time RFC 5280 has been misunderstood :-). Here is how I understand it:


Section 4.2.1.10 of RFC 5280 says:

The name constraints extension, which MUST be used only in a CA
certificate, indicates a name space within which all subject names
in subsequent certificates in a certification path MUST be located.

My understanding is that the constraint exists primarily for the use
of the CA software (like EJBCA) to constrain the certificates is issues
to only the permitted sub-trees.

I do not believe application software (such as browsers, e-mail, VPN
software, etc.) need care about the nameConstraints extension even
though they see it in the CA certificates of the chain. The reason is,
they have other ways of verifying the permitted subtree.

For example, a browser checks the subjectAltName extension for the
FQDN and matches it up with the FQDN of the web-site it is connected
to. If they do not match, you get the proverbial warnings. Since the
use of SAN is universal for server SSL certificates, what would it
matter if the nameConstraint had a completely different FQDN in the
permitted sub-tree (as long as the site and the SAN FQDN matched?

Similarly, Maul User Agents are able to verify the use of a digital
certificate for S/MIME against the e-mail header - which has the
sender and recipients' e-mail addresses. What would the RFC822 name
in the nameConstraint tell the MUA that it doesn't already know?

I believe the nameConstraints extension exists primarily for the use
of CA software vendors so that issuers of certificates can constrain
the issuance of digital certificates to permit or exclude sub-trees.

Am I misunderstanding this?

Arshad Noor
StrongAuth, Inc.


On 05/24/2012 11:58 PM, Tomas Gustavsson wrote:
>
> Hi Arshad,
>
> Currently you can use custom extensions to implement name constraints.
> We have done that for customers.
>
> The main responsibility is for the client, when verifying the
> certificate chain, to reject certificate violating the constraints.
> The client implementations for this is currently not perfect, with
> different flaws on various platforms, as our testing shows.
>
> I'd expect this to work better and be more widely deployed in the future
> though.
>
> Cheers,
> Tomas
>
> On 05/24/2012 10:14 PM, Arshad Noor wrote:
>> Hi,
>>
>> Not sure if I'm reading this correctly, but does EJBCA have support
>> for issuing/understanding certificates with the nameConstraints (OID
>> 2.5.29.30) extension in them, so it can only issue certificates that
>> conform to the constraint? I don't see any reference to this
>> constraint in its documentation.
>>
>> I did find an old e-mail that seems to indicate that PrimeKey does
>> NOT recommend this extension:
>>
>> http://osdir.com/ml/java.ejbca.devel/2006-02/msg00092.html
>>
>> Unfortunately, because of all the problems recently with CAs being
>> compromised, TTP CAs are now planning to enforce the use of this
>> extension to limit their liability. However, the CA software must
>> be able to support the use of the constraint and check all CSRs to
>> see if the constraint is satisfied before issuing the certificate.
>> I'm unable to find anything in EJBCA docs that indicate this is
>> supported; can someone please provide some clarification? Thanks.
>>
>> Arshad Noor
>> StrongAuth, Inc.

_____________________________________________

Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_____________________________________________

Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] nameConstraints extension support in EJBCA

[ejbca-support <ejb...@pr...>]

On 2012-05-25 18:33, Arshad Noor wrote:
> Hi Tomas,
> 
> Thanks for your response; I will look into the Custom Extensions
> section of the EJBCA documentation and see how easy/difficult it is
> to include the constraint in CA certificates.
> 
> However, I believe you and I may have a misunderstanding about how
> the nameConstraints extension is used - although this is not the first
> time RFC 5280 has been misunderstood :-).  Here is how I understand it:
> 
> 
> Section 4.2.1.10 of RFC 5280 says:
> 
>     The name constraints extension, which MUST be used only in a CA
>     certificate, indicates a name space within which all subject names
>     in subsequent certificates in a certification path MUST be located.
> 
> My understanding is that the constraint exists primarily for the use
> of the CA software (like EJBCA) to constrain the certificates is issues
> to only the permitted sub-trees.

As I understand it, name constraints is a part of path validation which
means that clients indeed MUST check them as well.  There was a giant
discussion on PKIX recently where there was a proposal to make this
a SHOULD since some leading clients do not implement this check.

The prime target for name constraints are Sub-CA certificates; a root
may do whatever it wants.

EJBCA does currently not check name constraints but that will be added
at a future date.

Regards
Anders

> 
> I do not believe application software (such as browsers, e-mail, VPN
> software, etc.) need care about the nameConstraints extension even
> though they see it in the CA certificates of the chain.  The reason is,
> they have other ways of verifying the permitted subtree.
> 
> For example, a browser checks the subjectAltName extension for the
> FQDN and matches it up with the FQDN of the web-site it is connected
> to.  If they do not match, you get the proverbial warnings.  Since the
> use of SAN is universal for server SSL certificates, what would it
> matter if the nameConstraint had a completely different FQDN in the
> permitted sub-tree (as long as the site and the SAN FQDN matched?
> 
> Similarly, Maul User Agents are able to verify the use of a digital
> certificate for S/MIME against the e-mail header - which has the
> sender and recipients' e-mail addresses.  What would the RFC822 name
> in the nameConstraint tell the MUA that it doesn't already know?
> 
> I believe the nameConstraints extension exists primarily for the use
> of CA software vendors so that issuers of certificates can constrain
> the issuance of digital certificates to permit or exclude sub-trees.
> 
> Am I misunderstanding this?
> 
> Arshad Noor
> StrongAuth, Inc.
> 
> 
> On 05/24/2012 11:58 PM, Tomas Gustavsson wrote:
>>
>> Hi Arshad,
>>
>> Currently you can use custom extensions to implement name constraints.
>> We have done that for customers.
>>
>> The main responsibility is for the client, when verifying the
>> certificate chain, to reject certificate violating the constraints.
>> The client implementations for this is currently not perfect, with
>> different flaws on various platforms, as our testing shows.
>>
>> I'd expect this to work better and be more widely deployed in the future
>> though.
>>
>> Cheers,
>> Tomas
>>
>> On 05/24/2012 10:14 PM, Arshad Noor wrote:
>>> Hi,
>>>
>>> Not sure if I'm reading this correctly, but does EJBCA have support
>>> for issuing/understanding certificates with the nameConstraints (OID
>>> 2.5.29.30) extension in them, so it can only issue certificates that
>>> conform to the constraint?  I don't see any reference to this
>>> constraint in its documentation.
>>>
>>> I did find an old e-mail that seems to indicate that PrimeKey does
>>> NOT recommend this extension:
>>>
>>> http://osdir.com/ml/java.ejbca.devel/2006-02/msg00092.html
>>>
>>> Unfortunately, because of all the problems recently with CAs being
>>> compromised, TTP CAs are now planning to enforce the use of this
>>> extension to limit their liability.  However, the CA software must
>>> be able to support the use of the constraint and check all CSRs to
>>> see if the constraint is satisfied before issuing the certificate.
>>> I'm unable to find anything in EJBCA docs that indicate this is
>>> supported; can someone please provide some clarification?  Thanks.
>>>
>>> Arshad Noor
>>> StrongAuth, Inc.
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop