EJBCA 7.11 Release Notes

DECEMBER 2022 FEBRUARY 2023

The EJBCA team is pleased to announce the release of EJBCA 7.11.

This release includes enhancements to our CMP implementation, usability improvements, compliance updates, and more. This release also upgrades Bouncy Castle to version 1.72.

Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.

Highlights

Revocation Reason Change

Addressing Mozilla's Root Store Policy, this release introduces the ability to change the revocation reasons for previously revoked certificates. Changing revocation reason is enabled at the Certificate Authority level, and backdating is allowed if set in the relevant Certificate Profile. The new revocation reason can only be Key Compromise. The revocation reason can be changed through the EJBCA REST API, RA Web UI, and Web Services. For more information, see Allow Changing Revocation Reason in CA Fields and Allow Backdated Revocation in Certificate Profile Fields.

RA Validation of CMP Messages

For EJBCA deployments with a peer-connected RA separate from the CA where the CMP protocol is used for enrollment, EJBCA 7.11 now provides a new option in which the CMP messages are validated on the RA before being forwarded to the CA. The validation applies to signature-protected messages as well as to HMAC-protected messages. Aside from providing enhanced security in deployments using CMP for enrollment, it allows customers to migrate to a standard peer-connected EJBCA CA/RA configuration following the deprecation of the CMP Proxy and External RA in EJBCA 7.11. For more information, see CMP.

Partial Support for CMP Lightweight Profile

With EJBCA 7.11, a subset of the CMP Lightweight Profile is available for use with CMP in EJBCA. CMP Lightweight profile defines a specified subset of CMP operations and functionality, mainly targeting industrial and IoT use cases including resource-constrained devices. With this release, support has been added for message protection with PBMAC-1 as well as the P10CR message body. For more information, see CMP.

Separation of Keybindings into OCSP Responders and Remote Authentication

To improve usability, the OCSP Key Bindings and Authentication Key Bindings configurations have been replaced with new OCSP Responders and Remote Authenticators pages in the EJBCA CA UI. User input for OCSP Responder and Remote Authenticator configuration is now tailored to each use case, while the Internal Keybindings concept is still used internally. The behavior of existing key bindings is not affected by this usability change. For more information, see Remote Authenticators Overview.

Announcements

Validation CLI Tool Removed

As announced in previous upgrade notes, the legacy CLI-based Validation Tool has now been removed from EJBCA.

Deprecation of External RA and CMP Proxy

As of EJBCA 7.11, the use of External RA and CMP Proxy is deprecated. Customers previously using the CMP Proxy are advised to migrate to RA Validation of CMP messages in a peer-connected CA/RA setup.

Upgrade Information

Review the EJBCA 7.11 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.

EJBCA 7.11.0 is included in EJBCA Hardware Appliance 3.11.0, EJBCA Software Appliance 2.3.0, and EJBCA Cloud 3.0.

EJBCA 7.11.0.1 is included in EJBCA Hardware Appliance 3.11.1 and EJBCA Software Appliance 2.3.1.

Change Log: Resolved Issues

The following lists fixed bugs and implemented features in EJBCA 7.11.

Issues Resolved in 7.11.0.1

Released February 2023

Bug Fixes

ECA-11227 - Key Recovery data not stored using P11NG

Issues Resolved in 7.11.0

Released December 2022

New Features

ECA-9261 - Allow enrollment of SSH Certificates over the RA Web

ECA-9263 - Allow SSH certificates to be searched in the RA web

ECA-10522 - Add support for ECDSA Authentication in peers using TLS 1.2

ECA-10813 - Support for PBMAC1 algorithm in CMP

ECA-10816 - Support for P10CR request body in CMP

ECA-10963 - End entity profile for SSH

ECA-10965 - Add support for SHA3 ECDSA signature algorithms to P11NG

ECA-10980 - GUI: Ability to toggle revocation reason change

ECA-10981 - Invoke publisher when revocation reason is changed.

ECA-10982 - Backend: Allow revocation reason change

ECA-10997 - RA Web support for revocation reason change

ECA-11023 - CMP Alias Configuration for "Extended validation"

ECA-11034 - Check if CMP extended validation via peers is enabled

ECA-11096 - Add cache for signer certificate in CMP servlet

ECA-11119 - Custom 'Expire' header for OCSP

ECA-11134 - Implement full support for Ra Mode HMAC protection when using Extended Validation

Improvements

ECA-10541 - Improve RoleMembers in Partitioned approvals

ECA-10691 - Split Keybindings page into OCSP Keybindings and Authentication Keybindings

ECA-10719 - Remove ValidationTool

ECA-10937 - Make entity e-mail field unchecked by default for RFC 822 in End Entity Profile

ECA-10940 - Inject cross-certificates in CA Certificate chains for ACME (and others)

ECA-10946 - Add Certificate validity start and end date option in RA Web

ECA-10947 - Remove hardcoded DB name in mysql-privileges.sh

ECA-10952 - Extract AD group membership from PAC (MSAE)

ECA-10959 - Add PKUP in View Certificates

ECA-10961 - Changes in external properties are not detected sufficiently fast

ECA-10969 - CryptoToken page: Add IDs to the form elements so that test automation can identify them unambiguously

ECA-10976 - Shortened IPv6 Parsing Errors in 7.9.0

ECA-10988 - p11ng: implement better detection for vendor-specific behaviour

ECA-10992 - Add option to enforce HTTPS client authentication for ACME

ECA-10999 - Allow MSAE LDAP queries to follow LDAP referrals

ECA-11008 - Merge P11NG changes from SignServer

ECA-11012 - Request: Add new Index to create-index-ejbca.sql

ECA-11049 - Configurable non-expired preproduced OCSP responses

ECA-11052 - Improve error handling of EjbcaWS.cvcRequest

ECA-11059 - Improve error message for future revocation date (RA-Web)

ECA-11060 - RA-Web Change of revocation reason || Rendering conditions

ECA-11061 - Improve /v2/endentity/search pagination and documentation

ECA-11063 - Make SSH source-address field searchable in RA

ECA-11065 - Create placeholder methods for RA Validation of CMP message

ECA-11066 - Signature verification of cmp message in RA

ECA-11067 - Support P10CR request body in cmpclient

ECA-11083 - Add MAC verification to CmpServlet

ECA-11092 - Minor language and UI improvements

ECA-11093 - Move database.useSeparateCertificateTable above database settings in sample config file

ECA-11094 - Validate Certificate status in CMP message

ECA-11120 - Full French language and some GUI localization support, contributed by David Carella of Linagora.

ECA-11124 - Add cache clearing to CMP Servlet and fix test

ECA-11126 - Fix cmp message signature validation in Client Mode

ECA-11131 - Oracle DB grants updated not to require DBA or admin rights

ECA-11139 - Support either of multiple authentication modules in CMP extended validation

ECA-11143 - Add PBMAC1 support for extended CMP validation

ECA-11144 - Add test related for p10cr in CmpExtendedValidationTest

ECA-11145 - Allow CMP CERT_REQ requests in HMAC mode with extended validation

Bug Fixes

ECA-10401 - Force local key generation option should not be visible in Community

ECA-10799 - Renamed CAs stuck in "List Of Vendor CAs" in EST alias

ECA-10859 - CA imported with empty name

ECA-10874 - Documentation for WildFly 24 specifies PKCS12, while JKS are generated

ECA-10894 - Configure OCSP extensions to always return if configured

ECA-10897 - Azure OAuth OID Approval Prompt with AWS EJBCA Issues

ECA-10919 - REST Certificate search V2 returns totalCert = null when certificates size is 0

ECA-10925 - Special characters in IssuerDN not displayed correctly when reviewing certificate

ECA-10929 - Pkcs12 content for PEM with enrollment with key recovery enabled

ECA-10930 - CMP request without Content-Length returns wrong HTTP status code

ECA-10953 - "Flush item" sometimes flushes a different item from the queue

ECA-10954 - Default rules preset require /administrator/ in REST

ECA-10958 - Saving Service config page takes too long when selecting large number of CAs

ECA-10962 - Execution error when approving certificate in RA Web

ECA-10967 - Concurrent requests to adminweb cause interrupted page loads and uppercase text

ECA-10970 - Key Pair Created In The Wrong Slot For Crypto Token When 2 Tabs Are Open

ECA-10989 - EJBCA CE Test Build Fail (false positive)

ECA-10990 - Delete EE Subject DN Field with Same DN Attribute and Validation merges fields

ECA-10991 - 'Required' has no effect at Key recovery options

ECA-10998 - Use Username and Request ID are missing from RA web

ECA-11004 - ConfigDump import fails when signing CA of SubCA is non-existent

ECA-11005 - NullPointerException in SCEP GetCACert when CA name is incorrect

ECA-11011 - REST max results increase stopped working

ECA-11017 - Adding a CT log with specific usage period causes exception

ECA-11020 - Fix issue with FQDN in SAN for MSAE

ECA-11025 - EndEntity profile Subject field validation runs against the wrong field

ECA-11029 - ClientToolBox creates not correctly DER wrapped OCSP Nonce extension

ECA-11031 - Revisit EndEntityManagementSession TRIM queries

ECA-11033 - Change revocation reason for Pre-cert revocation Service

ECA-11041 - Revocation backdate does not survive approval.

ECA-11042 - Revocation reason PRIVILEGE WITHDRAWN text does not show proper

ECA-11044 - Upgrade apache common-text to 1.10 and commons-lang3 to 3.12.0

ECA-11045 - fix encryptpwd not to require running appsrv

ECA-11047 - Not able to delete soft/p11 cryptotoken (CE Contribution)

ECA-11048 - Revocation backdate/change reason fix for partitioned approval.

ECA-11051 - ACME EAB Issue upgrading from 7.8.2 to 7.10.0.1

ECA-11054 - cmpclient missing libs

ECA-11056 - Publishing is interrupted if one item in queue cannot publish

ECA-11058 - Unable to upload cert file to enable the OCSP responders.

ECA-11068 - configdump - "Use entity e-mail field" checkbox at a RFC 822 Name (e-mail address)

ECA-11073 - REST endpoint profile related issues

ECA-11090 - Updating remote keybindings should generate key names with "-" instead of "_"

ECA-11095 - Make client certificate revocation effective for ACME over peers

ECA-11122 - Remove location header for acme order post-as-get

ECA-11123 - "ejbca.sh cryptotoken list" returns list without details for P11NG Tokens

ECA-11127 - ConfigDump can fail with NPE when importing CMP configuration

ECA-11138 - Fix language file