.png){kind=logo}
EJBCA 8.3 Upgrade Notes
Below are important changes and requirements when upgrading from EJBCA 8.2 to EJBCA 8.3.
For upgrade instructions and information on upgrade paths, see Upgrading EJBCA. For details of the new features and improvements in this release, see the EJBCA 8.2 Release Notes.
Behavioral Changes
Changed behavior of REST API createcrl endpoint
Previously, when using /v1/ca/{issuŠµr_dn}/createcrl with 'deltacrl' set to "false", it resulted in the creation of a base CRL. When set to "true", it was supposed to create a base CRL and attempt to create a delta CRL, but it was empty because no certificates were revoked since the previous base CRL was created. Now, when the 'deltacrl' parameter is set to "true", it results in the creation of a delta CRL, and when set to "false", it creates a base CRL.
ocsp.untilNextUpdate, ocsp.maxAge and ocsp.expires.useMaxAge have been moved from ocsp.properties into database configuration.
These properties will be automatically be migrated from ocsp.properties into the database, can now be modified from the UI or ConfigDump instead and may be removed from ocsp.properties after upgrade. See the OCSP Overview page for more information.
Stricter Subject DN validation
Previous versions of EJBCA would accept but silently change malformed parts of Subject DN components when there are un-escaped characters.
For example, "CN=Example=Test" would become "CN=Example".
Since EJBCA 8.3, these will now give an error. In particular, the SOAP API will respond with an EjbcaException with the message "badly formatted directory string" and the REST "endentity" call will give HTTP error 400.
Pre-certificate revokation service
The service has a changed behaviour and hence a new name. It is now called Pre-certificate maintenance service, and the revokation of the not fully issued certificates which are residing in the IncompleteIssuanceJournalData table is now optional.
It could be configured via GUI under the Services configuration page in EJBCA admin web. It is recommended to keep this option disabled. It will by default be disabled for the newly created services (EJBCA 8.3 and onwards) and for the services created in the older versions, it will be enabled by default, to preserve the backward compatibility.