EJBCA 7.4.1 Release Notes

The PrimeKey EJBCA team is pleased to announce the release of EJBCA 7.4.1.

With this release, we have implemented Microsoft Intune Device Enrollment support, allowing devices to be set up to directly request certificates from the EJBCA RA. This release also brings the ability to have Multiple DVCAs with the same Holder Country and Mnemonic.

Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.

Highlights

Microsoft Intune Device Enrollment

Intune is Microsoft's cloud-based device management solution, and EJBCA can be configured as the CA backend to allow devices to enroll for certificates. Intune support has previously been provided through a 3rd party connector, but from EJBCA 7.4.1 devices can be set up to directly request certificates from the EJBCA RA. This is set up using SCEP aliases, and we provide a guide for setting up your enterprise for Intune Device Enrollment from start to finish. 

Ability to have Multiple DVCAs with the same Holder Country and Mnemonic

In the context of CV certificates, EJBCA has traditionally used the holder mnemonic and requesting country code to build the Subject DN, causing a uniqueness constraint. EJBCA 7.4.1 allows multiple DVCAs to share the same country and mnemonic fields. For more information, see Managing CVC CAs.

Security Issue

As a part of standard testing, we found a minor security issue which has been fixed in this version of EJBCA. When employing a client certificate to authenticate an EST client, we've discovered that no check is performed on the status of this certificate, allowing a revoked client to still request certificates over EST. The vulnerability only affects EST, and can be mitigated by removing the affected client certificate from the roles which allows it to perform enrollments. This vulnerability will be published as a CVE two weeks following the release of EJBCA 7.4.1 and the distribution of security announcements to customers. 

Upgrade Information

Review the EJBCA 7.4.1 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.

EJBCA 7.4.1 is included in EJBCA Hardware Appliance 3.5.3 and EJBCA Cloud 2.3 and can be deployed as EJBCA Software Appliance.

Change Log: Resolved Issues

For full details of fixed bugs and implemented features in EJBCA 7.4.1, refer to our JIRA Issue Tracker.

Issues Resolved in 7.4.1