Skip to main content
Skip table of contents

Local Signing of Attestations with Chainloop and EJBCA Ephemeral Certificates

With this integration, Chainloop can be configured to generate short-lived signing certificates by using EJBCA as the certificate authority (CA), enabling a user experience similar to Sigstore Fulcio’s “keyless” approach.

There are some key differences compared to the SignServer approach:

  • The client will not need access to the PKI infrastructure, and Chainloop will be in charge of exchanging the CLI identity for a short-lived certificate signed by EJBCA. Simplifying authentication.

  • The signing process will happen locally, in the client.

  • The verification materials and the final attestation can optionally be downloaded as a Sigstore Bundle for further offline verification.

Prerequisites

Before you begin, you need:

A running EJBCA instance - Click to learn more

If you don’t already have EJBCA installed, here are some options for you:

How to Configure Chainloop to use EJBCA as CA

To enable enable Chainloop to use EJBCA as its certificate authority, you must add your EJBCA settings to your Chainloop Helm Chart configuration.

For complete instructions and examples on how to sign Chainloop attestations with EJBCA-issued certificates, refer to the How-to guide: Use Keyfactor EJBCA to generate ephemeral signing certificates in the Chainloop documentation.

Once you have done so, the attestation process will not require providing any signing material; the resulting attestation will be automatically signed.
> chainloop attestation push

Next steps

In this guide, you learned how to set up Chainloop to use EJBCA as CA for local signing of attestations with ephemeral certificates.

Here are some next steps we recommend:

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.