Configure via EJBCA Cloud Configuration Wizard

The following covers how to configure EJBCA using the Cloud Configuration Wizard.

If you are using the 1.x version of EJBCA Enterprise Cloud, proceed to the next step Log in to EJBCA Cloud AWS to retrieve the SuperAdmin certificate from your instance.

Step 1: Host Settings

In the first step, you configure the host settings for the instance.

1. The host name is automatically detected but can be modified. The host name must match the name of the host or DNS name that will be entered into a browser when accessing the Administration Interface of this EJBCA installation.

2. Using a Subject Alternative Name (SAN) with this host can be done so that a public URL can be used to access EJBCA. For example, if you would like to use https://pki.company.com/ to access a cluster of hosts, you can enter that DNS name into the wizard to be added as a SAN in the instance's TLS certificate. To use this feature, select the option to specify a Valid domain name. Note that the wizard will not verify that the domain name is a valid domain, but will confirm that the syntax is a recognized domain format.

3. Click Next to continue to the database configuration.

Host Settings Fields

The following lists available fields.

Step 2: Database Configuration

Database configuration is optional. By default, a local MariaDB server is installed. Alternatively, you can configure an external database using MariaDB, PostgreSQL, Microsoft SQL Server, or Oracle Database.

When using Oracle Database, you must configure an Option Group to enable TLS. When enabling TLS, use a FIPS-compliant cipher suite such as TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS 1.2. FIPS mode itself does not need to be enabled.

You can choose either to perform a new installation or to join a node to an existing EJBCA database.

2a: New Installation

To use a cloud-hosted database such as Amazon RDS or Aurora:

1. Select the option to use an external database and enter the database information including Access URL, username, password and database name. The RDS or Aurora engine can be MariaDB, PostgreSQL, Microsoft SQL or Oracle Database.  AWS configures TLS on all deployed databases automatically. 
   If using Oracle Database, follow the AWS documentation to configure an Option Group that enables TLS connectivity.
   Ensure that the RDS or Aurora instance is properly configured before proceeding. For more information, refer to AWS documentation Create an RDS DB Instance.

2. Click Test to verify the database connection. You cannot proceed unless the test is successful. This should be a fresh RDS instance with no existing EJBCA database. If the database exists already and the Existing EJBCA Database option is cleared, the wizard will give the error Database exists!. If this database was created ahead of time, it can be dropped since the database is created automatically by the wizard.
   If the RDS Database instance is unavailable for any reason, the installation will fall back to a local installation to ensure success. The only way to recover from this is to export the database, import it into RDS, and reconfigure the node to point to a cloud database. It is recommended to fix the database connectivity problem and launch a new node from the Marketplace. The most common problem connecting to a cloud database is security group configuration. Ensure that the EJBCA Cloud instance is allowed to talk to the RDS instance.

3. Once the database connection is successful, the Success message is shown.

4. Click Next to continue to Step 3: Management CA Configuration.

2b: Cluster Join

To join a node to an existing EJBCA database, provided you already have a database with an existing EJBCA installation:

1. Select Existing EJBCA Database (cluster join)? to join this node to an existing EJBCA installation.
   Ensure that the EJBCA CLI password matches the original password of "ejbca".
   Provide the password for the EJBCA application database user (ejbcadbuser). By default, this matches the admin password unless it has been changed using the rotate_db_password.sh script, see Database Password Rotation AWS.

2. Click Test to verify the connection. The wizard verifies both database connectivity and the existence of the specified database. If the database is not found, the test fails and you cannot proceed.

3. When Existing EJBCA Database (cluster join)? is enabled, all other options in the wizard are disabled and you can continue to Step 5: Review and Submit.

Database Configuration Fields

The following lists available fields.

Step 3: Management CA Configuration

The Management CA can either be created during the installation or imported from an existing Management CA.

Create a new Management CA

EJBCA will create a Management CA based on attributes of the system to guarantee uniqueness. You can optionally import an existing Management CA to the instance and have certificates from that CA be allowed access to this installation, see Use Existing (Import) Management CA.

Note that the only required field when creating a new Management CA is the Superadmin password. For all available fields, see Management CA Configuration Fields below.

Management CA Configuration Fields

The following lists available fields. Note that the only required field is the SuperAdmin password.

Use Existing (Import) Management CA

You can optionally import an existing Management CA to the instance and have certificates from that CA be allowed access to this installation.

When importing an external Management CA, a role will be added for the supplied, case sensitive, Common Name (CN) provided. For example, if you supply "jsmith" as the username to be added, you must have a keystore issued to "jsmith" from the CA whose public certificate you are providing. The most common use case is an existing Management CA from another EJBCA installation and a SuperAdmin certificate to match.

You must have a keypair generated with the Common Name supplied from the CAs public certificate you are uploading to this instance when choosing Import CA.

To use an existing Management CA with this instance, do the following:

1. Select Use existing ManagementCA.

2. Click Browse and select the public certificate from the existing Certificate Authority.

3. Enter the Common Name (CN) for the user for which you have a keystore from this CA.

4. Click Next to continue to the Review and Submit page to review a summary of all settings.

Step 4: CloudHSM Configuration

This step is optional and not applicable if you selected Use Existing ManagementCA (since this means that no CA keys will be created.)

By default, EJBCA creates keys for the Management CA in the database. CloudHSM key generation can be configured now so that the initial Management CAs keys are stored and created in CloudHSM. If you would like to have those keys created in a CloudHSM cluster, you can enter the credentials for your cluster here.

Before proceeding:

• Complete CloudHSM setup according to the EJBCA Cloud AWS CloudHSM Integration Guide.

• Ensure the required security group rules allow communication with the CloudHSM cluster.

• Have your customerCA.crt file available.

Testing connectivity to the CloudHSM cluster before the installation is not possible. Therefore, if the EJBCA installation fails to connect to the CloudHSM cluster with the credentials provided for any reason, the setup will fall back to a soft key pair generation so the EJBCA installation itself does not fail. There may be more details in the log file /var/log/install.log on the EJBCA host as to why installation with CloudHSM failed if it does.

To set up your own HSM later, skip this step and click Next to continue to the Review and Submit page to review a summary of all settings.

CloudHSM Configuration Fields

The following lists available fields.

Step 5: Review and Submit

This page displays a summary of your configuration.

• Click Submit to begin installation.

• Click Previous to modify settings if needed.

After submission, installation begins and a log viewer is displayed.

When complete, you are redirected to the EJBCA RA interface to retrieve your SuperAdmin credentials.