EJBCA 7.7.0 Release Notes

JULY 2021

The PrimeKey EJBCA team is pleased to announce the release of EJBCA 7.7.0.

Running hot on the heals of EJBCA 7.6.0, this feature release is our final push towards full Microsoft Windows compatibility before the summer. With this release, we're aiming to be able to offer a fully holistic solution to any Microsoft based enterprise looking to power their PKI with the easiest, fastest, and most powerful solution available.

Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.

Highlights

Microsoft Windows Compatible CA Key Updates

Due to some differences in how Microsoft Windows handles CRLs, we've introduced a Microsoft Compatibility mode that changes the CA's behavior when the CA is rekeyed. The commonly expected behavior when a CA is rekeyed, is that all future CRLs and OCSP responder certificates are signed by the new key pair after the rollover. Instead, Microsoft environments expect each generation of CA key pairs to continue signing CRLs for those certificates which were issued by that particular key pair. Likewise, OCSP responses are expected to be continued to be signed with an OCSP responder certificate signed by the original key pair.

The end result of Microsoft Compatibility mode is that:

The CA will produce as many CRLs as there are generations of CA keys.
OCSP responses will have different signing keys, depending on which generation of CA keys signed the relevant certificate.

Microsoft Compatibility mode comes with some caveats:

It's not possible to switch between the two modes, so Microsoft Compatibility Mode must be enabled upon CA creation if required.
Microsoft Compatibility Mode is mutually exclusive with the use of Partitioned CRLs.

For more information about EJBCA's Microsoft Compatibility mode, see Microsoft Compatible CA Key Updates.

Approvals in ACME Workflow

Upon popular demand, we have implemented Approvals for the ACME workflow. Configuring Approvals for a CA or Certificate Profiles and enrolling over ACME will now trigger an approval event for the account and subsequent end entity creation. For more information, see ACME.

Azure Blob CRL Publisher

To further increase compatibility with the Microsoft space, we have introduced a CRL publisher to Azure Blob. For more information, see Azure Blob Storage Publisher.

Announcements

Sunset of JDK8 support

With JDK8 seeing the end of its official support window from Oracle, we will towards the end of this year sunset support for JDK8 ourselves to be able to take advantage of the many features in JDK11 and later. We want to recommend all customers to upgrade their JDKs to JDK11. With the coming release of JDK17 as the next LTS release from Oracle, we will be implementing full support towards the autumn.

Upgrade Information

Review the EJBCA 7.7.0 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.

EJBCA 7.7.0 is included in EJBCA Hardware Appliance 3.9.0 and EJBCA Cloud 2.8.0 and can be deployed as EJBCA Software Appliance.

Change Log: Resolved Issues

For full details of fixed bugs and implemented features in EJBCA 7.7.0, refer to our JIRA Issue Tracker.

Issues Resolved in 7.7.0

Released July 2021

New Features

ECA-3085 - Option to start audit log verification from a specified sequence number

ECA-10074 - Azure CRL Publisher

ECA-10180 - ACME Name Generation Scheme

Improvements

ECA-9797 - Documentation is missing for "extension_data" field in REST calls

ECA-9863 - SCEP: add option to include CA chain in the GetCACert call (update for RFC8894)

ECA-10050 - GUI option for Microsoft conformant CA creation

ECA-10051 - OCSP Responder support for multiple signer keys

ECA-10080 - Make ms conformant setting irreversible in other end points

ECA-10081 - Improve DynamicUiProperty field validation user mesages

ECA-10084 - UI: Hide "Partition CRL Settings" when "MS Key Updates" is enabled.

ECA-10085 - CA signKey must correspond to partition.

ECA-10086 - Suspend previous CRL partition with CA key re-keying.

ECA-10087 - Enforce Partition CRLs with MS CA Key Updates

ECA-10091 - Add approvals for ACME account management

ECA-10140 - Enforce CRL Distribution Point in Edit CA page if MS CA Compatibilty mode is selected

ECA-10152 - Enforce Use of Authority Key ID

ECA-10153 - Generating Default CRL Dist. Point should use partition suffix

Bug Fixes

ECA-9805 - Enrollment code not shown in RA web when using key recovery

ECA-10138 - Single Active Certificate Constraint sets revocation date to 1970

ECA-10166 - IntuneRevocationWorker is missing setting for AUTH_AUTHORITY in 7.7

ECA-10167 - CA certificate CDP not updated on MS CA re-keying

ECA-10174 - SCEP Issuance has incorrect log message

ECA-10194 - Azure CRL Publisher Not Publishing CRLs via peer

ECA-10197 - CRL Publisher label wrong

ECA-10198 - Azure CRL Publisher fails unless password entered