MAY 2021

The PrimeKey EJBCA team is pleased to announce the release of EJBCA 7.5.0.1. (EJBCA 7.5.0 was an internal release, not generally available for customers.)

The primary focus of this release has been integration with other elements of the PKI ecosystem, not least of which full integration of Microsoft Auto-enrollment into the EJBCA RA and support for authenticating to the CA and RA UIs and REST through OAuth. 

Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.

Highlights

Microsoft Auto-enrollment Integration

Until now PrimeKey has supplied an Auto-enrollment proxy in order to allow customers to integrate single domain Microsoft PKIs with EJBCA as a backend.

From version 7.5, EJBCA now has Microsoft Auto-enrollment support fully integrated, not only transcending the need for a proxy but also eliminating the need for a Certificate Enrollment Policy server or Certificate Enrollment Server, with the EJBCA RA being the point of first contact for enrolling clients. EJBCA 7.5 also allows for multi forest support, letting all your domains integrate into a single PKI through the same endpoint. For more information, see Microsoft Auto-enrollment Overview.

With the new Microsoft Auto-enrollment integration in EJBCA 7.5, we are announcing end of sale and end of support for the former PrimeKey Auto-enrollment proxy.

  • End of sale as of EJBCA Enterprise 7.5.
  • End of support and maintenance in May 2022.

OAuth Authentication to the EJBCA CA and RA UIs and REST API

Moving on from the classic support for client certificates to access the CA and RA UIs, and the REST API, EJBCA 7.5 now supports access using an OAuth provider over OpenID. So far we've tested and confirmed authentication using KeyCloak and Azure Active Directory. 

ACME External Account Bindings

Long requested, we've implemented ACME External Account Bindings in accordance with RFC 8555 section 7.3.4. External Account Bindings allows the client to specify a unique ID number that is associated with that ACME account, and in our implementation we've associated the ID with each issued certificate for easy lookup later. In addition to being able to authenticate the ID using a MAC as per the RFC, we've also allowed for using a signature from a locally issued certificate instead.

For more information on managing ACME External Account Bindings in EJBCA, see ACME.

EST Client Mode

We've added Client Mode to EST as with CMP and SCEP. Unlike RA mode, Client Mode only allows issuance against previously created end entities and does not automatically enroll new ones. This workflow is optimal for IOT use cases, where a limited set of devices need to enroll to your PKI. 

HSM support for Ed25519 and support for AWS Cloud HSM

Apart from earlier software support for the signature algorithms Ed25519 and Ed448, support has been added for using Ed25519 with selected HSMs which support Ed25519, starting with nCipher nShield, Thales Luna and SoftHSMv2. This support is only available when using P11-NG Crypto Tokens in EJBCA. In conjunction with this, EJBCA is now fully compatible with the AWS Cloud HSM.

Compliance 

OCSP Support Updated to Conform to RFC 8954

We have updated our OCSP responder to conform with the clarifications specified in RFC 8954, specifically to how EJBCA handles client generated nonces. 

eIDAS Compliance

  • Support has been added in the CA UI for easy editing of the new Legislation Country QC Statement as specified in ETSI EN 319 412-5 v2.3.1 section 4.2.4.
  • Support for multiple SemanticIdentifier to a single certificate, i.e. to specify both EN 319 412-1 Natural Person and Legal Person at the same time.
  • CAs can now be configured to automatically generate a CRL upon revocation.

CA/Browser-Forum Compliance

Ballot SC44 limits the allowed redirect codes by complying CAs. These changes are planned to be implemented in EJBCA in version 7.6, due in the end of May.  

Upgrade Information

Review the EJBCA 7.5 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.

EJBCA 7.5.0.1 is available on EJBCA Hardware Appliance 3.7.1 and EJBCA Cloud 2.6.1 and can be deployed as EJBCA Software Appliance.

Change Log: Resolved Issues

For full details of fixed bugs and implemented features in EJBCA 7.5, refer to our JIRA Issue Tracker.

Issues Resolved in 7.5.0.1

Released May 2021

New Features

ECA-6630 - Create YAML export for CMP configuration

ECA-6689 - Not possible to issue CA certificates through the RA web

ECA-9441 - Implement support for a keystore using FIPS compliant algorithms

ECA-9484 - Support for Ed25519 in P11NG

ECA-9490 - General Account Binding (GAB)

ECA-9491 - ACME External Account Binding (EAB)

ECA-9492 - ACME EAB Configuration UI

ECA-9494 - ACME EAB Implementation as specified in RFC8555

ECA-9495 - ACME EAB Implementation for public key signature validation

ECA-9500 - Add support for new eIDAS QC statement esi4-qcStatement-7, Legislation

ECA-9525 - Optionally, add cache header for OCSP unauthorized response

ECA-9527 - Add Role as standard DN field

ECA-9550 - Prevent deployment of EJBCA after a hardcoded date

ECA-9561 - ACME IP Identifier Validation http-01 Challenge

ECA-9572 - Create MSAE Servlet module in EJBCA

ECA-9633 - Support Thales DPoD

ECA-9671 - Option to disable http-01 challenge for ACME wildcard certificates

ECA-9696 - Make the ACME order validity configurable

ECA-9724 - Add XCEP implentation in the msae package

ECA-9737 - Add EST client mode

ECA-9738 - CLI support to create new Crypto Token with Azure key vault (ejbca.sh ca cryptotoken)

ECA-9762 - Read token and give access (RA Web)

ECA-9767 - Add MS Intune Azure Active Directory authentication URL to SCEP alias

ECA-9771 - Add Intune verification Auth. URL to SCEP alias configuration

ECA-9780 - Add MSAE to protcol configuration

ECA-9816 - Add Intune resource URL and Graph related fields to SCEP alias configuration and mask app key field

ECA-9817 - Add CRL generation upon revocation and configdump

Epics

ECA-9005 - Integrate Microsoft Autoenrollment (MSAE) into the EJBCA RA

ECA-9624 - OAuth Support

ECA-9716 - CRL Generation upon revocation

Improvements

ECA-4750 - Change default configuration of User Notice text to use UTF-8

ECA-7391 - Only show CA-related approvals in CA Web (and vice versa)

ECA-7844 - The space before the Validator name is not trimmed

ECA-8350 - Implement 'revokeCert' resource authorization for an ACME account holding all of the identifiers in the certificate

ECA-8705 - Deleting items with dependencies

ECA-8940 - Make P11-NG an optional provider for EJBCA

ECA-9006 - Certificate Template Enrollment Authorization Bypass

ECA-9282 - Replace outmoded language in EJBCA

ECA-9361 - Add "Flush" and "Republish" to publisher queue view

ECA-9378 - Improve the error logging for OCSP response generation

ECA-9475 - Make REST search result limit rely on global config

ECA-9489 - Add support for key unwrapping in P11-NG provider

ECA-9526 - Fix OWASP job in Jenkins

ECA-9532 - ACME system test failures

ECA-9533 - ACME EAB config dump

ECA-9540 - Selenium setup script fails in EJBCA CE

ECA-9554 - Update nimbus-jose-jwt-8.19.jar to latest release 9.1.2

ECA-9573 - Invoke RaMasterApi from MSAE Servlet

ECA-9600 - Documentation improvement: E-mail Notification Configuration in EEP

ECA-9608 - Separate CP5 functionality from regular P11 in P11-NG

ECA-9611 - ACME EAB UI layout and code convention improvements

ECA-9612 - Log which CMP message type is received

ECA-9613 - Improve ACME EAB ConfigDump

ECA-9626 - Add selenium tests for ECA-8705

ECA-9627 - Improve ACME EAB Implementation for public key signature validation GUI

ECA-9628 - Issue a qualified certificate with multiple Semantics Identifier (OIDs)

ECA-9629 - Library upgrade in MSAE Servlet

ECA-9646 - Re-enable OAuth configuration in CA UI

ECA-9657 - Configure Keycloak login url

ECA-9664 - MSAE Servlet Kerberos authentication

ECA-9667 - Fix failing unit tests in Jenkins

ECA-9670 - Improve Documentation: Remove meaningless instruction in REST example script

ECA-9673 - Change kerberos configuration runtime

ECA-9687 - Improve clean up of ACME nonce data

ECA-9701 - Make it possible to query different AD machines from EJBCA server.

ECA-9704 - OAuth login page for RA UI

ECA-9715 - Improve caching for Azure Crypto Token

ECA-9718 - Unit test for OAuth request

ECA-9720 - Minor UX improvements for OAuth

ECA-9728 - Query AD Policies from XCEP Service

ECA-9729 - Encrypt ACME EAB symmetric key

ECA-9730 - Make the CES (MSAE) implementation a Java WebService

ECA-9731 - Option to use SSL / TLS AD connection in MSAE

ECA-9732 - UI Configuration for MSAE

ECA-9753 - Merge CertUtils and CertTools

ECA-9754 - Convert AD time format to Java

ECA-9761 - Fix JSF dynamic UI components update of value range

ECA-9766 - Replace static list of AD Templates in MSAE UI Configuration

ECA-9772 - Refactor MSAE AD Connection

ECA-9773 - CEP Service: Invoke AD connection from external package

ECA-9774 - CES Service: Invoke AD connection from external package

ECA-9775 - Create unit tests for MSAE ASN1 helper class

ECA-9784 - Add default P11 provider path for AWS CloudHSM

ECA-9785 - Rename PKCS#11 CP5 to PKCS#11 NG in crypto token driver select list

ECA-9796 - Add a CLI command to view detailed information about an OAuth provider

ECA-9804 - MSAE UI option for policy name

ECA-9811 - Support SHA256 and SHA512 RSA signatures for certificates issued by RSA based SSH CAs

ECA-9835 - Read AD templates dynamically from CESService

ECA-9838 - REST End Entity Management enabled by default

ECA-9845 - Try to authenticate using OAuth when client certificate authentication fails

ECA-9846 - Pin OAuth role members to a specific provider

ECA-9858 - Support SHA224WithECDSA in P11-NG

ECA-9875 - REST unable to pkcs10Enroll when EE profile uses auto generated password

ECA-9878 - ACME pre-authorization system test

ECA-9894 - Allow usage of JWK public key for OAuth

ECA-9901 - Strip trailing slash from OAuth URL for KeyCloak providers

ECA-9907 - Update mapped AD template settings

ECA-9910 - Set ACME problem response content type to application/problem+json

ECA-9913 - Fallback to database is CEP Service CA cert isn't found in cache.

ECA-9917 - Prevent the user from adding public keys with duplicate keyids

ECA-9923 - Administrator name should not be UUID when logging in with KeyCloak

ECA-9960 - Revisit MSAE libs

ECA-9964 - Allow CEP service to represent multiple CAs

ECA-9965 - Rename default provider type

Bug Fixes

ECA-6010 - CLI importcacert can't import CA chain certificates

ECA-7447 - Disable "set password" in RA web if end entity profile enrollment code is "auto-generated"

ECA-7485 - EEP default CA selection doesn't work on adminweb EE creation and RaWeb enrollmakenewrequest pages

ECA-8499 - Not possible to mix Sun PKCS#11 and CP5 PKCS#11 tokens

ECA-8947 - The CLI command mergecatokens is not working for CAs with token type provider Pkcs11NgCryptoToken

ECA-9140 - CA Structure & CRLs links do not work if CA DN contains &

ECA-9155 - Certificate is generated without Username

ECA-9317 - When "Use entity CN field" In The EEP is Enabled, it is not visible on adminweb while adding EE

ECA-9499 - Security Issue

ECA-9534 - Wrong label in end entity profile: "UID, Unique Identifier" subject DN field should be "userid"

ECA-9543 - Fix DynamicUiProperty / DynamicUiModel property validation.

ECA-9544 - Insert DynamicUiModel JSF into existing table grid

ECA-9545 - Fix DynamicUiProperty / DynamicUiModel component enabling / visibility

ECA-9546 - Adding RA Proxying of EjbcaWS.softTokenRequest

ECA-9549 - Incorrect encoding of non-english languages in RA web on Java 11

ECA-9558 - Multiple choices of the same curves in certificate profile - unable to enroll ECDSA prime256v1 certificate via RA Web

ECA-9565 - Make the CE index page show the correct version information

ECA-9568 - Remove the final/static keywords from EJB methods

ECA-9586 - Regression: First letters of first DC component in CA DN always capitalized

ECA-9590 - CA signing algorithm suggestion defaults to SHA1WithRSA after selecting crypto token

ECA-9615 - Regression: When selecting multiple keys in a crypto token the wrong key(s) are removed

ECA-9619 - Remote internal key binding updater service fails with nullpointer exception

ECA-9622 - Null pointer exception is thrown when the CA tries to issue a certificate using a corrupt CSR

ECA-9630 - Regression: EST re-enroll stopped working due to authorization of re-enrolling entity

ECA-9632 - ExtendedInformation is not parsed correctly by SecureXMLDecoder for some values

ECA-9634 - Fix ACME revokeCert resource for revocations for account holders having all authorizations for the identifiers in a certificate

ECA-9638 - Fix ACME EAB exception handling

ECA-9640 - CMP 3GPP: Unable to enroll Ericsson eNodeB in Vendor Mode

ECA-9656 - EJBCA will debug log a private key if sent with CSR

ECA-9660 - Cannot enroll over ACME using an EC keypair

ECA-9661 - No check if Allow Subject DN Override by CSR in REST

ECA-9666 - Missing space in TLS error message

ECA-9675 - SCEP – null name for End Entity generated instead of DN serialNumber

ECA-9714 - Some system tests failing on processing PKCS10 requests

ECA-9721 - Error Admin UI rendering creating CAs with crypto token errors

ECA-9726 - Regression: error about ApprovalData column when exporting using ejbca-db-cli

ECA-9727 - REST API fail to enroll CSR with Subject Directory Attribute

ECA-9736 - Regression: Add/Edit End Entity actions are not logged to Audit Log

ECA-9741 - RA web ignores Subject Directory Attributes in user CSR

ECA-9749 - Regression: Intune not working, upgrade intune libraries

ECA-9764 - Fix failing configdump unit tests in Jenkins

ECA-9765 - Regression: EjbcaWS.processSoftTokenReq does not work when end entity already exist

ECA-9768 - REST API: NullPointerException enrolling end entity without ExtendedInformation

ECA-9783 - Warnings printed from CEP Service on startup

ECA-9802 - Regression: Response to acme endpoints is not correct in all cases.

ECA-9805 - Enrollment code not shown in RA web when using key recovery

ECA-9806 - AlgorithmTools is spamming the log, lower log level for list of available algorithms

ECA-9807 - Workaround C_GetAttributeValue bug in AWS CloudHSM

ECA-9808 - CE build broken. Package org.cesecore.keys.token.p11ng.provider does not exist (in CE)

ECA-9809 - Unable to sign RSA public keys with SSH CA

ECA-9815 - OAuth login page is not shown when authentication fails on a JSP page

ECA-9822 - Regression: ejbcaClientToolBox.bat does not work

ECA-9824 - Edit CA resets Extended Services Key Specification for CMS CA Service

ECA-9839 - Theoretical NPE in EjbcaWebBeanImpl

ECA-9841 - OAuth provider without keys cannot be deleted

ECA-9847 - Regression: Missing library in CMP HTTP proxy

ECA-9851 - OAuth Client Secret should be input type password

ECA-9853 - OAuth refresh token assumes there is also an access token

ECA-9855 - Security issue

ECA-9859 - Read profiles via Peers for MSAE UI Configuration

ECA-9860 - Same MSAE policy UID is used for all machines

ECA-9862 - MSAE AD password is shown cleartext

ECA-9871 - Fix trace interceptor invocation duration

ECA-9872 - Regression: Peer publishing between 7.5 and older is broken

ECA-9873 - Error clicking "previous" CA certificate in CA structure certificate view

ECA-9877 - External RA: Unable to access external RA

ECA-9886 - Fix ACME pre-authorization order creation

ECA-9887 - Security Issue

ECA-9895 - Oauth login fails in chrome

ECA-9896 - Failed to get token from authorization server. HTTP status code 401

ECA-9900 - Fix AcmeConfiguration upgrade method.

ECA-9904 - LDAP Connection resets regularly

ECA-9908 - Test connection doesn't use the saved password

ECA-9909 - List of "Available MS Templates" isn't sorted

ECA-9912 - Incorrect table definition in sql script for MS-SQL for OcspResponseData.rowProtection

ECA-9916 - Implement oid claim for Azure

ECA-9919 - PKCS11HSMKeyTool fails with missing jna dependency

ECA-9924 - AD Search Scope too narrow

ECA-9931 - Security hardening

ECA-9932 - Fix exception with "default method" in Java on some environments

ECA-9933 - Must enter client secret again when saving OAuth provider

ECA-9938 - OAuth login in RA UI does not work over peer connection

ECA-9949 - OAuth: Failed to get token from authorization server.

ECA-9954 - Regression: NPE when getting non-existent configuration over peers, when debug logging is enabled

ECA-9956 - Conf files update is not reflected

ECA-9958 - Regression: NPEs on System Configuration page

ECA-9959 - MSAE SAN DNS Contains only domain part

ECA-9963 - EstRAModeBasicTest failing due to typo in expected error string

ECA-9967 - Errors in CA UI when TLS session is restarted

ECA-10042 - ACME EAB secret key logged on debug level