EJBCA 7.6.0 Release Notes

JUNE 2021

The PrimeKey EJBCA team is pleased to announce the release of EJBCA 7.6.0.

This release continues this spring's push to develop EJBCA as the preeminent solution for Enterprise PKIs, with further integration with Microsoft PKIs. It also brings to light External Account Bindings, an important concept for anybody needing to handle large volumes of device certificates. Included in this release are also the changes made in EJBCA 7.5.1, which was only released internally.

Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.

Highlights

External Account Bindings

Inspired by the concept of External Account Bindings in ACME (supported since EJBCA 7.5), we've extended the concept globally across EJBCA to provide a quick and easy way to link any certificate enrolled via the RA, REST, or ACME with an external identifier, to affiliate certificates to identities.

Subsets of allowed values can be pre-configured in the certificate profiles to ensure that only valid identities can be submitted, as well as providing content assistance in the RA.

Microsoft Intune Revocation and Other Improvements

Published and documented as recently as May of this year, Microsoft Intune now provides the ability to request revocation of certificates from Azure. EJBCA 7.6.0 has full support for this API in the form of a Service Worker which will periodically poll Azure for new revocation requests.

In addition, the following improvements have been made to our Intune support:

AD Authentication to Azure can now be made with a certificate instead of a username/password.
The connection between the CA and Azure can now be piped through an EJBCA RA, doing away with any requirements on the CA to have a direct connection to Azure.

Microsoft Azure Managed HSM (MHSM)

In addition to supporting Azure Key Vault, EJBCA now supports the new Managed HSM (MHSM) which offers FIPS 140-2 Level 3 for a higher assurance level to protect your keys in the cloud. Using the same REST API as Key Vault, you can add an MSHM instance as an Azure Key Vault Crypto Token (or several instances as separate crypto tokens).

Testing Baseline raised to JDK11

While JDK11 has been in use for some years among customers, we have internally raised the baseline from JDK8 to JDK11, which is now the recommended JDK to use with EJBCA. We will in the coming months be announcing the sunset of JDK8 support, and are looking forward to supporting JDK17 as soon as it's been released by Oracle.

Compliance

Compliance with CA/Browser Forum Ballot SC44

CA/Browser Forum ballot SC44 redefined some return codes for ACME, to which EJBCA 7.6.0 is now fully compliant.

Security

EJBCA 7.6.0 comes with fixes for a few minor security issues, as well as additional security hardening.

General Purpose Custom Publisher able to Run Despite External Scripts Being Disabled

It was found during testing that the General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run. Two weeks after the release of EJBCA 7.6.0 this issue will be reported as a CVE.

Severity

Low – creating and changing a publisher would still require super admin access to EJBCA, and modifying any existing scripts would require operating system access.

Enrollment Secrets Logged in Audit Log

When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log. Two weeks after the release of EJBCA 7.6.0 this issue will be reported as a CVE.

Severity

Low – enrollment secrets are already by definition known among system administrators and only trusted users should have audit log access.

Enrollment Secrets Reflected in UI

As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on the page. While hidden from direct view, checking the page source would reveal the secret. Two weeks after the release of EJBCA 7.6.0 this issue will be reported as a CVE.

Severity

Low – anybody with access to the configuration page likely has access to the secret as well, and is authorized to change the secret.

CMP Revocation Ignores Multi Tenancy Constraints

CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

Severity

Medium – while not as serious as ignoring multi tenancy constraints for enrollment, this allowed tenants to perform DoS attacks on each other. The attacking party still needed to be a known and trusted entity.

Upgrade Information

Review the EJBCA 7.6.0 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.

EJBCA 7.6.0 is included in EJBCA Hardware Appliance 3.8.0 and EJBCA Cloud 2.7.0 and can be deployed as EJBCA Software Appliance.

Change Log: Resolved Issues

For full details of fixed bugs and implemented features in EJBCA 7.6.0, refer to our JIRA Issue Tracker.

Issues Resolved in 7.6.0

Released June 2021

New Features

ECA-8220 - CMP: possibility to configure Issuing CA certificate included or not in the caPubs field

ECA-9476 - Make it possible to restore end entity and certificate data from the WildFly log file

ECA-10043 - Update Intune dependencies

ECA-10078 - Add validation and display useful error messages

ECA-10090 - Validation of uploaded EAB config

ECA-10114 - Update documentation with RA web changes

ECA-10123 - Secret Input For Custom Worker UI

Improvements

ECA-7640 - End entity editor in the RA Web

ECA-8473 - Support other authentication than password for Azure Key Vault Crypto Token

ECA-9276 - Support client certificate authentication for Azure Intune for SCEP enrollment

ECA-9553 - ACME EAB Documentation

ECA-9685 - Improve German translation for AdminWeb and RA

ECA-9832 - Security hardening

ECA-9836 - Add option to SCEP Alias to disable SHA-1 digest algorithm in responses

ECA-9936 - Add handling of unsupported role member types

ECA-9942 - Compile statedump-ejb without access to appserver

ECA-9996 - Migrate the OCSP transaction log and the OCSP audit log to the GUI

ECA-10001 - Give ACME aliases with EAB the option to generate the symmetric key

ECA-10021 - Add EAB support to REST for /v1/certificate/pkcs10enroll

ECA-10028 - Update REST Search functionality with the EAB ID

ECA-10029 - Add the EAB ID field to the RA Enroll page

ECA-10034 - Decide in a format that has namespace support

ECA-10061 - Security hardening

ECA-10064 - Language improvement and typo updates

ECA-10065 - Support Azure MHSM as a Key Vault crypto token

ECA-10079 - Help text on EAB upload page

ECA-10098 - Preview of uploaded EAB namespaces under System Configuration

ECA-10101 - Security hardening

ECA-10102 - Multi-select for EAB Namespaces in Certificate Profile

ECA-10165 - IntuneRevocationWorker is missing setting for AUTH_AUTHORITY

Bug Fixes

ECA-7972 - CN is not copied to dNSName when "Use entity CN field" is enabled in the end entity profile

ECA-9330 - Security Issue

ECA-9558 - Multiple choices of the same curves in certificate profile - unable to enroll ECDSA prime256v1 certificate via RA Web

ECA-9660 - Cannot enroll over ACME using an EC keypair

ECA-9975 - Pre-produced OCSP responses are only published to the first VA

ECA-9985 - DeltaCRL creation time

ECA-9999 - Incorrect response to ACME challenge URL when using POST-as-GET

ECA-10020 - Regression: CSR Upload in the RA Web causes spontaneous redirect to blank page

ECA-10022 - Fix ACME pre-authorization NPE and empty list of authorizations

ECA-10044 - Fix ACME EAB shared key encryption from RA

ECA-10048 - Security issue

ECA-10073 - Saving CA resets Subject Alternative Name field

ECA-10082 - Security issue

ECA-10083 - Autoenrollment: Clear header from outgoing SOAP message when one already exists

ECA-10088 - Autoenrollment: Enrollment permission check is too strict

ECA-10089 - Security issue

ECA-10093 - SSH settings must not be displayed in CE edition End-Entity Profile edit form

ECA-10097 - Regression: Security exception and missing classes on classpath when importing using EJBCA DB CLI

ECA-10104 - Regression: Exception occurs when viewing certificate

ECA-10106 - Signing of data larger than 20 KiB with ECDSA and PKCS#11 NG (e.g. eIDAS HSM) fails

ECA-10109 - Signing of data larger than 20 KiB with AWS KMS and Azure Key Vault fails

ECA-10113 - Maximum number of failed login attempts not working via RA Web

ECA-10116 - Run CRL partition index db update in post-upgrade instead of upgrade at a startup

ECA-10122 - Unable to set Intune key binding in SCEP configuration

ECA-10125 - Intune Scep Serialization Error

ECA-10129 - Intune revocation missing SCEP fields

ECA-10132 - Azure Crypto Token using cert auth with auto activation shows inactive when restarting wildfly

ECA-10133 - Fix selenium

ECA-10134 - EAB namespaces broken for configdump

Issues Resolved in 7.5.1

Internally Released May 2021

New Features

ECA-9270 - Allow Intune verification to be performed from the RA

ECA-9441 - Implement support for a keystore using FIPS compliant algorithms

ECA-9972 - Create a Service Worker for Intune Revocation

ECA-10010 - Use configured CAs

ECA-10016 - SCEP servlet should update intune after cert issuance

Improvements

ECA-9658 - ACME agree to new ToS

ECA-9792 - Add a button for importing certificates to an OCSP responder

ECA-9833 - Configdump SCEP Import/Export with Intune settings

ECA-9898 - ACME: Limit followed redirect codes according to CABForum Ballot SC44

ECA-9974 - The domain ignore list used for CAA validation should be consistent with how domains names in certificates work

Bug Fixes

ECA-9372 - "Any CA" in Ocsp Pre-Signer Service has no effect

ECA-9408 - Security hardening

ECA-9903 - Remove Apache Velocity from /lib

ECA-9977 - Regression: ejbca.sh fails to import endentities profiles with notifications - need commons-lang3

ECA-9984 - Allowed Characters changing after disabling User Storage

ECA-10000 - p11ng-cli signperformancetest calculates signings per seconds incorrectly

ECA-10007 - MSAE Configuration displays in VA instances

ECA-10017 - Fix FindBugs warnings related to OAuth