.png){kind=logo}
EJBCA 8.0 Release Notes
JUNE 2023
The EJBCA team is pleased to announce the release of EJBCA 8.0.
This release includes advancements in IoT security, SSH certificate issuance, and post-quantum readiness.
Deployment options include EJBCA Software Appliance, EJBCA Cloud, and EJBCA Hardware Appliance.
Highlights
SSH certificates
EJBCA 8 includes the new Certificate Authority (CA) type SSH CA capable of issuing Secure Shell Protocol (SSH) certificates. The use of SSH certificates for certificate-based authentication in SSH rather than SSH key distribution and management allows organizations to both increase productivity and improve security. Enabling SSH servers and clients to trust the CA means that SSH can leverage the power of PKI.
With EJBCA you can now issue SSH certificates in addition to X.509 certificates, Card Verifiable certificates, and C-ITS certificates. SSH certificate enrollment is supported through the EJBCA REST API and the EJBCA RA user interface. For more information, see SSH CA.
EST over CoAP in EJBCA LRA Software Appliance
In order to extend deployment flexibility EJBCA 8 enables the deployment of a Local Registration Authority (LRA) to issue birth certificates or operational certificates in IIoT and IoT use cases. Resource-constrained devices can enroll for certificates using EST over CoAP. Running EST over CoAP in EJBCA 8 requires using an EJBCA LRA Software Appliance connected to an EJBCA Certificate Authority (CA).
General EST support in EJBCA 8 has also been extended to support server-side key generation. Server-side key generation may be used regardless of whether EST is carried over HTTP or CoAP.
Post-Quantum Readiness
EJBCA 8 includes support for creating CAs using the NIST round 3 candidate post-quantum signature algorithms Dilithium and Falcon. The standardization of these algorithms is planned to be finalized by INST in 2024. These algorithms are not for production use but are well suited for post-quantum preparation activities and proof of concept usage. For more information on post-quantum algorithm support in EJBCA, see Post-Quantum Cryptography Keys and Signatures.
Matter Smart Home support
Matter is a new standard for interoperable and secure smart home devices. Matter security is based on certificates and the required certificates can be issued by EJBCA using new subject DN attributes as specified in the Matter standard. For more information, see Create CAs for Matter IoT.
Fortanix DSM support
EJBCA 8 includes a new crypto token type enabling integration with Fortanix Data Security Manager (DSM) Cloud HSM through the Fortanix REST API. For more information on the REST integration and creating the Fortanix crypto token in EJBCA, see Fortanix Data Security Manager.
ACME improvements
EJBCA 8 adds support for DNS Identifier Validation using the tis-alpn-01 Challenge. ACME has also been extended to support HS384 and HS512 MAC algorithms.
ISO 15118-20 (EV charging) support
Extended EJBCA functionality related to SubjectKeyIdentifier and AuthorityKeyIdentifier enables setting up EJBCA 8 to issue certificates according to the requirements specified in ISO 11518-20.
Certificate Counting
A new REST endpoint enables counting the number of issued and active certificates.
Technology upgrades
As a new major version the technology stack supported by EJBCA 8 includes some important updates compared to EJBCA 7. EJBCA 8 supports running on Java 17 in addition to Java 11. Running on Wildfly 26 as application server is also supported and the EJBCA use of application server is based on JEE8. Bouncy Castle has been upgraded to version 1.73.
Announcements
Security Issue
EJBCA 8.0 resolves an authentication issue discovered in EJBCA 7.12.0 that allowed the EJBCA RA user interface certificate distribution servlet to allow partial denial of service.
We rate the issue as having a severity level of medium. Once EJBCA 8.0 has been generally available across all platforms for at least two weeks, a CVE with the identifier CVE-2023-34196 will be published.
Public Web not supported
EJBCA Public Web has been deprecated since EJBCA 7.9 and is no longer supported in EJBCA 8. Customers are advised to use the functionality available in the EJBCA RA user interface.
Running on Java 8 not supported
Running on Java 8 has previously been deprecated and EJBCA 8 does not support running on Java 8.
Old application servers not supported
Running EJBCA 8 on WildFly 10-22 as well as JBoss EAP 7.0-7.3 is not supported. WildFly 26 and JBoss EAP 7.4 are currently the recommended application servers for running EJBCA 8.
Removal of End Entity Printing Functionality
As of this version of EJBCA, we have removed the functionality to print End Entities using SVG templates, as this feature was rarely used and not maintained.
Removal of cesecore-p11.jar and CKA_MODIFIABLE=false
This feature was added a while back to provide a workaround for a vulnerability that has long since been patched by HSM vendors. This workaround does not work in JDK11 and above, so has been removed.
Removal of CMS Signing for Audit Logs
CMS signing was rarely used and required signatures from a soft key stored on the CA. This functionality has been removed from the audit log pages, as well as the accompanying CA settings.
Removal of the legacy asynchronous CMP Proxy
The legacy CMP Proxy, which allowed the CA to poll a database for incoming CMP requests, has been retired and removed. The main purpose of acting as a proxied CMP endpoint has been redundant for some time by the EJBCA RA, and the last remaining functionality that was available on the proxy has now been rolled into the RA as well.
Removal of the legacy asynchronous SCEP Proxy
Like the CMP proxy above, the SCEP proxy has been redundant for quite some years by EJBCA acting as RA. It has now been fully removed.
Removal of ECDSA ImplicitlyCA
The ECDSA ImplicitlyCA functionality has long been discouraged from use, and support has now been entirely removed from EJBCA. Note that ImplicitlyCA has nothing to do with explicit ECDSA parameters.
Upgrade Information
Review the EJBCA 8.0 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.
EJBCA 8.0 is included in EJBCA Software Appliance 2.4 and EJBCA Cloud 3.2. EJBCA 8.0 will also be included in the EJBCA Hardware Appliance 3.12 release.
Change Log: Resolved Issues
The following lists fixed bugs and implemented features in EJBCA 8.0.
Issues Resolved in 8.0.0
Released June 2023
New Features
ECA-9249 - Implement ConfigDump for SSH Certificate objects
ECA-9260 - Create a REST call to request an SSH certificate
ECA-9264 - Allow SSH CA public keys to be downloaded in SSH format from the RA web
ECA-9562 - ACME DNS Identifier Validation tls-alpn-01 Challenge
ECA-9856 - Add validity override option to REST /v1/endentity
ECA-10968 - Initial PoC support for Falcon and Dilithium PQC algorithm using soft token and non-official OIDs
ECA-11136 - CMP HMAC validation in Client Mode (Extended validation)
ECA-11146 - Modify language clue about security strength from only NTRU to PQC general
ECA-11154 - Support EC point compression in issued certificates if CSR has it
ECA-11177 - Fortanix crypto token type
ECA-11201 - Add RFC9336 Document Signing built-in extended key usage
ECA-11248 - Ability to include language files from custom publisher plugins
ECA-11258 - Add Matter IoT specific DN components
ECA-11266 - Make max number of jobs for a publishing queue worker configurable.
ECA-11283 - Create tests for CoAP REST endpoint
ECA-11296 - Support Subject and AuthorityKeyIdentifier method 2
ECA-11297 - Add PQC KEM algorithm NTRU as available algorithms in Certificate Profile
ECA-11298 - Add documentation of PQC support
ECA-11300 - Ability to order Key Identifier extensions in specific order
ECA-11328 - Add protocol configuration for REST CoAP
ECA-11363 - Correct test failure in Jenkins related to ticket ECA-11328
ECA-11367 - Est server side key generation
ECA-11377 - CoAP Support for EST Server Side Key-gen
ECA-11378 - CoAP Support for EST 'simplereenroll'
ECA-11432 - Add options to select encryption and wrapping algorithm in clientToolBox SCEPTest command
ECA-11433 - Add support for RSA-OAEP decryption in P11NG
ECA-11440 - Missing support IPv6 for SANs in CMP protocol
ECA-11453 - REST API endpoint for counting issued and active certificates
ECA-11457 - Add uniqueIDentifier and certificationID DN components
ECA-11504 - Document initial support for IBM HPCS HSM using P11NG
ECA-11520 - OCSP responder support for CertId using SHA384 and SHA512 in OCSP requests
Improvements
ECA-8627 - Allow multiple CRL Updater Services to run in parallel
ECA-9536 - Replace configurable header JSP file path with a header selection/upload
ECA-10442 - Add placeholder for certificate serial number in decimal format to e-mail notifications
ECA-10686 - Remove commons-digester
ECA-10688 - Upgrade commons-io to 2.11 or later
ECA-10903 - Improve logging for ACME EAB failures
ECA-10971 - Create an exportable x509-cert-utils module
ECA-10987 - Don't rely on presence of TLS session tickets when detecting type of public access role member
ECA-11064 - Return list of supported JWS algorithms if ACME EAB request uses an unsupported JWS algorithm
ECA-11075 - Add "verify-required" critical option
ECA-11164 - Update ldap.jar to latest version
ECA-11165 - Upgrade log4j to 2.19.0
ECA-11167 - Extend ACME available MAC algorithms to HS384 and HS512
ECA-11170 - Remove reference to velocity.log from build.xml
ECA-11178 - Upgrade woodstox-core to 6.4.0
ECA-11180 - Upgrade Google Guava to version 31.1 or later
ECA-11188 - Rewrite the Validators Page to conform with emerging UX practices
ECA-11189 - Always check revocation status of certificates during authorization
ECA-11191 - Remove calls to deprecated constructors of Integer and Float
ECA-11192 - Cleanup: Update deprecated BouncyCastle references
ECA-11196 - Refactor some CRL related classes and code.
ECA-11199 - Update commons-configuration2 --> 2.8.0
ECA-11214 - Upgrade EJBCA to use CDI
ECA-11215 - Upgrade to javaee-api-8.0.1
ECA-11216 - Allowing special character "+" in email address in AdminWeb add entity
ECA-11233 - Modify CryptoTokenTestRunner to include P11NG
ECA-11235 - Convert MBeans declared in CA UI's faces-config to use CDI instead
ECA-11261 - Remove CoAP endpoints from SwaggerUI
ECA-11264 - Reduce and upgrade javassist to version 3.29.2
ECA-11267 - Modify the Validators page to use a separate column for validator type
ECA-11269 - Refactor ACME Alias overview page according to current UX practices
ECA-11293 - EJBCA - Create an EST CoAP config API
ECA-11294 - CoAP server - Load EST config from EJBCA
ECA-11316 - Solve the root-resource mistery
ECA-11326 - Add handling of "Number of Allowed Requests" in code for race condition avoidance
ECA-11327 - Fix ACME system test failures false positives due to challenge validations
ECA-11373 - Add PQC key generation by the CA in RA Web
ECA-11376 - Remove deprecated call to CoreMatchers.containsString() in AcmeAssert.java
ECA-11390 - P11NG: Clear cache after login
ECA-11391 - CP improvement - Add only relevant key usages to certificates
ECA-11396 - Update default PKCS#11 libraries for Thales ProtectServer 2 and 3
ECA-11399 - Make scope UI configurable for PingID OAuth Provider
ECA-11400 - Remove unused classes
ECA-11401 - Move KeyTools.getBytesFromOauthKey and KeyTools.getKeyIdFromJwkKey out of x509-commons-util
ECA-11402 - Containerize CoAP Proxy
ECA-11404 - Est over coap access rule for Coap rest resource
ECA-11417 - Decrypt Intune client secret on CA
ECA-11426 - SSH Swagger UI example issues
ECA-11435 - Upgrade SnakeYaml to version 2.0
ECA-11436 - Update jackson libraries
ECA-11442 - Rewrite the Search End Entities page in the CA UI to JSF
ECA-11447 - Add warning about re-keying Root CAs
ECA-11451 - Update Swagger Codegen lib to v2.4.31 or later
ECA-11452 - TLS 1.3 Support for key bindings
ECA-11454 - Support decimal serialNr for EJBCA CLI revoke
ECA-11465 - Include SSH feature(s) in the standard EE build
ECA-11466 - 'Use Entity CN Field" for MS UPN
ECA-11474 - Replace tabs in System Configuration Screen with PrimeFaces tabs
ECA-11476 - RA web is not affected by Certificate Chain ordering
ECA-11486 - Fix key algorithm and key spec for PQC when view certificate in Ra web
ECA-11489 - Add ability to enable/disable Fortanix DSM crypto token in properties
ECA-11491 - Enable post-quantum algorithms by default
ECA-11500 - Updated EJBCA logo based on Keyfactor rebranding
ECA-11501 - Match all active vendor CA certificates with CMP vendor certificate mode
ECA-11502 - Evaluate MSAE deny permissions
ECA-11529 - Add margin for Search End Entity Buttons
ECA-11537 - Make ejbca.sh config available on RA / VA builds
ECA-11553 - editcapage: Add ID to the form elements so that test automation does not break with every single release
Bug Fixes
ECA-4347 - Race condition when multiple RA threads are requesting certificates for the same user
ECA-10304 - ACME Configuration: Modified settings reset after save.
ECA-10412 - Fix warnings
ECA-10754 - REST API: When hitting max_statement_time (or 'Maximum Query Timeout'), the request does not fail
ECA-11080 - AdminWeb: GetCrl with insufficient permissions results in 500 Error
ECA-11089 - Unable to Save Advanced Access Rules
ECA-11128 - Autoenrollment alias does not accept krb5 conf file if it is considered plain text
ECA-11137 - Can't view/edit Batch Generation / Clear Text Password state from RA GUI
ECA-11148 - Conflicting autogenerated password error at EE creation
ECA-11161 - Fix HMACAuthenticationModule extracted username bug
ECA-11174 - ZIP releases fail to build using Java 17
ECA-11194 - post upgrade failure from version 7.3.1.4 to version 7.10.0.1
ECA-11202 - WS javadoc fail after X509-Common-Util move
ECA-11203 - ant test:clientToolBox fails after x509-common-util
ECA-11210 - NPE when enrolling an EE with a revoked CA.
ECA-11213 - org.ejbca.core.protocol.scep.ProtocolScepHttpTest.test03OpenScep() failing
ECA-11222 - Internal error via REST API returns wrong status code
ECA-11229 - REST Endpoint accepting EST messages from CoAP Proxy
ECA-11231 - Fix testEjbcaVersion test
ECA-11263 - ejbca-ws-generate broken since upgrade to JEE8
ECA-11290 - UPN value not included in certificate if "Required" in EE Profile not selected
ECA-11292 - View End Entity page in Ra web is broken
ECA-11295 - Add getCertificateSignatureAlgorithm body in SshCertificateUtility
ECA-11310 - Regression: p11ng module missing from ejbca-ejb-cli
ECA-11317 - Process ACME wildcard certificates in order state ready
ECA-11329 - Regression: NPE trying to delete crypto token, checking presence in ACME EAB
ECA-11340 - BC version number not updated in jboss-deployment-structure.xml
ECA-11343 - CoAP server- NullPointerException on repeated enrollment requests
ECA-11346 - End entity profile validation logic for clear password and send notification
ECA-11355 - Fix classpath error in WS CLI
ECA-11369 - Fix compilation issue caused by ECA-11233
ECA-11380 - CRL Import via CA UI can't handle large CRLs
ECA-11412 - clientToolBox does not honor pkcs11.disableHashingSignMechanisms=false
ECA-11419 - PKCS11CryptoToken not working in CE on Java 17
ECA-11424 - Audit log timezone stuck in UTC
ECA-11425 - SSH User cert with principal
ECA-11430 - Remove RSA-OAEP mapping to RSA in ScepRequestMeassage
ECA-11431 - Error creating new CA when there are failed crypto tokens
ECA-11437 - clientToolBox SCEPTest should URL encode GetCACert CA name
ECA-11443 - Missing RA web language string for Matter DN components VID and PID
ECA-11444 - NPE when enrolling SSH certificate via REST
ECA-11455 - Algorithm key length can not be validated for dilithium algorithm
ECA-11458 - Properly handle Verify-required in RA web certificate pages
ECA-11459 - Fix output format of coap serverkeygen cbor response
ECA-11460 - Ensure P11NG CLI generated keys meet Utimaco CP5 HSM keyUsage constraints
ECA-11469 - OCSP Responder next key update "fail" in 7.11.0.1
ECA-11471 - VaPeerStatusServletSystemTest tests are failing
ECA-11475 - MSAE cannot handle commas "," in CN field
ECA-11477 - Update SafeObjectInputStream with KeyFactor classes
ECA-11478 - Security issue
ECA-11479 - Regression: adding new DN components does not work any longer
ECA-11487 - EC keys generation from REST endpoints does not work
ECA-11492 - Unable to download initial superadmin token from RA web
ECA-11499 - LDAP DN order field on edit SSH CA page does not update after clicking save button
ECA-11510 - Va functionality shows up in RA specific EJBCA build
ECA-11523 - Wrong comparison of Hash sets.
ECA-11525 - Crypto tokens created using ejbca.sh do not autoactivate
ECA-11532 - Remove "Asterisk in freshest CRL field" from documentation
ECA-11534 - Javascript does not run in View Certificate dialog, causing revocation confirmation to not show
ECA-11535 - Oauth link does not work in adminWeb
ECA-11538 - Unescaped single quotes blocks publisher type selection in CA UI
ECA-11539 - Protocol status icons are squashed up
ECA-11541 - After cloning a Validator, further edits also result in cloning
ECA-11550 - Fix regressions on the Search End Entities page in CA GUI
ECA-11558 - Infinite amount of Add Constraint rows
ECA-11563 - On open to view certificate on Search End Entities, Error 404
ECA-11564 - Remove "(unused)" from revocation reasons list on Search End Entities page
ECA-11565 - CA Gui search end entity advanced page match how operators gets reset on new added criteria