.png){kind=logo}
EJBCA 9.0 Release Notes
OCTOBER 2024
The EJBCA team is pleased to announce the release of EJBCA 9.0.
EJBCA 9 introduces a new technology stack as well as S/MIME CAA validation support. The release also includes other improvements as well as error corrections.
The EJBCA 9.0 release is exclusively available for software and container-based deployments. For available deployment options and associated versions, refer to Supported Versions.
Highlights
Upgraded Technology Stack
EJBCA 9 introduces support for running on an upgraded technology stack. As of version 9.0, the deployment prerequisites now include WildFly 32 or JBoss EAP 8 as the supported application servers, and Java 17 as the required runtime environment. While Java 17 is required for this release, Java 21 is planned for a future update in a later EJBCA 9 release.
Due to changes in recent WildFly versions and JBoss EAP 8, which are not backward compatible with WildFly 26 and JBoss 7.4, the upgrade from EJBCA 8 to EJBCA 9 requires a complete technology stack upgrade.
S/MIME CAA Validation Support
EJBCA 9 supports validating email addresses included in certificate subjects against DNS issuemail rules, in accordance with the S/MIME Baseline Requirements (S/MIME BR) and RFC 9495: Certification Authority Authorization (CAA) Processing for Email Addresses.
To enable a Certification Authority (CA) to validate against a DNS for S/MIME, the following prerequisites must be met:
“Email Protection” must be enabled in the certificate profile.
A Certification Authority Authorization (CAA) Validator with one or more issuers must be added to the CA.
When these conditions are met, the validator will query the DNS(s) to verify if the issuers are permitted to use the email domains specified in the Subject Alternative Name fields. For instance, for a certificate request with a subject alternative name like:
rfc822Name=john@example.com
the validator will check if the configured issuer(s) are allowed to issue certificates for emails including the example.com domain by querying the configured DNS(s).
Archive of EJBCA security issues
Keyfactor is strongly committed to responsible reporting and disclosure of security-related issues. As part of that commitment, we maintain a historical list of issues that have been fixed and submitted as CVEs (Common Vulnerabilities and Exposures), see Archive of EJBCA security issues.
Upgrade Information
Review the EJBCA 9.0 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.
Change Log: Resolved Issues
The following lists implemented features and fixed issues in EJBCA 9.0.
Issues Resolved in 9.0
Released October 2024
New Features
ECA-12286 Allow ACME dns-01 challenge with IPv6
ECA-12460 Add support for "issuemail" property tag in CAA Validator
ECA-12493 Add SDN support for Mark Certificates
ECA-12545 Implement check for close primes in RSA key validator
Improvements
ECA-10173 'mappedName' in annotations is not supported
ECA-11888 Ability to not read certificates on some P11NG crypto tokens \(CloudHSM\), use heuristic attribute buffer size when reading CKAs
ECA-12262 Replicated Database in CA
ECA-12365 Allow multiple EST templates to enroll using a Keyfactor Enroll CA
ECA-12395 "cryptotoken setpin" command should prompt twice for new password for confirmation
ECA-12401 Update cryptotoken libs
ECA-12408 Upgrade jee-api
ECA-12412 Specify version of the NGINX sidecar
ECA-12418 Use the CA certificate uploaded in EJBCA for Keyfactor Enrollment CA during EST getcacert
ECA-12436 Fix compilation error in Gradle \(after Jakarta 10 upgrade\)
ECA-12443 Upgrade xmlns to Jakarta EE version \(xhtml pages\)
ECA-12455 Convert view ee page to JSF
ECA-12470 Convert Edit EE page to JSF
ECA-12476 Reject issuance if using CAA with both serverAuth and emailProtection in profile
ECA-12483 Add support for S/MIME CAA lookups on ejbca-caa-cli
ECA-12484 Add support for port and protocol ejbca-caa-cli
ECA-12489 Migrate EST list of aliases page from JSF to primefaces
ECA-12490 Migrate My preferences page from JSF to primefaces
ECA-12500 Rewrite CAA Test to use the Test DNS Container
ECA-12524 MSAE LDAP connections should go through RA to outside world.
ECA-12550 Implement and document multiple TLS certifcate support in NGINX sidecar
ECA-12559 Fix typo in javadoc in EndEntityCertificateAuthenticationModule
ECA-12587 VA Peer Publisher throws NPE if CertificateData.base64cert is null.
ECA-12589 L10n: Admin GUI language fix \(ACME\)
ECA-12590 L10n: RA GUI French update \(based on 8.3.2\)
ECA-12591 L10n: Admin GUI French update \(based on 8.3.2\) Fully translated
ECA-12592 Fix help text for removeadmin CLI command
ECA-12593 Fix code typos paramter to parameter
ECA-12594 Fix typo in findendentity cli help
ECA-12619 Upgrade Apache CXF to 4.0.5
ECA-12624 Improve RA GUI layout
ECA-12629 Upgrade dnsjava to 3.6.1
ECA-12631 Upgrade undertow-core to 2.3.16/17
ECA-12632 Upgrade xnio-\* to 3.8.16
ECA-12647 Update CONTRIBUTING.md with test instructions
ECA-12648 Change doc link to new url
ECA-12672 L10n: French GUI fix \(Peer Systems\)
Bug Fixes
ECA-11540 "CMP Authentication Secret" field on Edit CA page gets auto-completed
ECA-12075 Add ACME Alias overwrites the old one if the same name is used
ECA-12288 Admin Web - Search End Entities - multi selection possible, but not working
ECA-12289 Admin Web - Search End Entities - Buttons are activated only after clicking on checkbox
ECA-12309 Admin Web - Certification Authority - Cannot download binary file of certificate request
ECA-12323 Invalid SQL for PostgreSQL when dropping index in UpgradeSessionBean
ECA-12359 Fix RSA-PSS on Windows in p11ng and update p11ng
ECA-12402 Bump Ingress max request body size
ECA-12422 External RA Cannot Query Peered CA Certificate Profiles
ECA-12425 Regression: KEC cache exception when clearing cache on Community
ECA-12428 Upgrade JDBC drivers used by EJBCA containers
ECA-12432 Output proper error message to CMP client when validation fails
ECA-12437 Importing a krb5.conf file for an MSAE alias erases all user input not stored
ECA-12438 CertificateRequest REST API fails after issuing certificate for invalid CA name
ECA-12440 SSH REST certificaterequest adds source\_address only if critical\_option is present
ECA-12459 Configdump - importing SSH CA does not allow CA healthcheck field to be specified
ECA-12461 Cannot create hybrid CA certificate with non-default CA certificate profiles
ECA-12463 UI Exception: javax.faces.Integer
ECA-12466 Certificate enrollment with the RA web inserts the e-mail into the RFC822name if checkbox is disabled
ECA-12468 REST API deployment issue with javassist lib
ECA-12469 A missing certificate lets EJBCA fail to startup if DEBUG / TRACE logging is enabled
ECA-12478 Get certificate profiles over peers in MSAE CESService
ECA-12487 Regression: Configdump - creating crypto token and soft keys
ECA-12488 Remove comma after CA name in Certification Authorities page
ECA-12492 Fix issues with addoauthprovider and oauthproviderkey CLI commands
ECA-12497 RA Web - Make Request - UI got deformed when too many SDN fields are used
ECA-12504 Table already exists warning with EJBCA 9
ECA-12508 Log reloaded properties on server log
ECA-12517 Regression: Download for CSR of newly created External CA fails with error 404
ECA-12518 Regression: p11ng-cli commands gives CRYPTOKI\_NOT\_INITIALIZED or CKR\_DEVICE\_ERROR
ECA-12519 clientToolBox does not work with edward curves
ECA-12549 Cannot delete oAuth configuration
ECA-12551 Resolve SLF4J logger warnings
ECA-12554 Database CLI is broken
ECA-12561 Cannot select ECC key in keyEncryptKey dropdown with p11ng crypto token
ECA-12580 Regression in username validation
ECA-12586 End entity list option is not sorted
ECA-12588 L10n: RA GUI English fix back \(regression\)
ECA-12596 RA Web - View EE displays link to certificates with adjacent username
ECA-12600 EST RA mode settings show up in client mode
ECA-12612 Incorrect CAA Validator message when issuance is prohibited
ECA-12622 Post-upgrade hangs when crldata\_idx3 or crldata\_idx4 exist
ECA-12626 EJBCA errors when deleting keys from a cloudshm v5 HSM
ECA-12627 SnakeCaseConverter is not working in Swagger UI
ECA-12635 Incorrect version of slf4j in settings.gradle.kts
ECA-12638 CAA S/MIME validation is not applied to SAN In extension in request
ECA-12639 Environment variable expansion breaks ConfigDump import
ECA-12640 REST API /v1/certificate/pkcs10enroll fails with CA with name null does not exist
ECA-12644 Statedump is not working with Java 17
ECA-12651 Regression: RA Web - Inspect CSR - Unhandled error while uploading empty file
ECA-12660 Regression - Statedump fails with IllegalArgumentException when CryptoToken KeyPairInfo KeyUsage is null.
ECA-12662 EJBCA container test for- Statedump is not working with Java 17
ECA-12667 Fix NPE at cryptotoken init
ECA-12670 Update cert-cvc to fix very rare padding issue with EC signatures
ECA-12673 Regression: Admin Web - Publishers - Edit Form gets deformed when many publishers available
ECA-12674 Ejbca-Db-Cli "verify" throws exception and "export" commands has issues with ampersand character in database.url
ECA-12684 Port the Statedump Java 17 fix to the container