Renew certificate #686

pragyasandeep1998hal · 2024-10-10T15:15:44Z

pragyasandeep1998hal
Oct 10, 2024

Hi I want a code to renew a revoked certificate. Can you provide java code for this or any reference

primetomas · 2024-10-10T15:31:46Z

primetomas
Oct 10, 2024
Maintainer

There are probably about 1 million ways to do that.

Have fun, with some examples :-).
https://github.com/Keyfactor/ejbca-ce/tree/main/modules/systemtests
https://docs.keyfactor.com/ejbca/latest/cmp-operations-guide#id-(latest)CMPOperationsGuide-cmpclientsupport

0 replies

pragyasandeep1998hal · 2024-10-15T10:07:27Z

pragyasandeep1998hal
Oct 15, 2024
Author

I tried to renew a certificate by tag 7 kur [7] CertReqMessages, --Key Update Request inside PKIBody in PKIMessage

Getting error:

2024-10-15 10:02:08,920+0000 INFO [org.ejbca.ui.web.protocol.CmpServlet] (default task-3) CMP message received from: 172.19.91.116, for CMP alias: CMP-Server
2024-10-15 10:02:08,921+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Received CMP message with pvno=2, sender=4: C=IN,ST=DEL,O=CAP,CN=RANI,UID=RANI, recipient=4: CN=TESTCMP
Cmp configuration alias: CMP-Server
The CMP message is already authenticated: false
Body is of type: 7
Transaction ID: #3131323132
2024-10-15 10:02:08,921+0000 INFO [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Dispatching message of type 7 with transaction ID: #3131323132
2024-10-15 10:02:08,922+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Add CA certificates of CAs '-1296251422' to the CMP response message caPubs field.
2024-10-15 10:02:08,922+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Get CA by ID: -1296251422
2024-10-15 10:02:08,922+0000 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-3) 2024-10-15 10:02:08+00:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;172.19.91.116;;;;resource0=/ca/-1296251422
2024-10-15 10:02:08,922+0000 DEBUG [org.cesecore.audit.log.InternalSecurityEventsLoggerSessionBean] (default task-3) LogDevice: Log4jDevice Proc: 0
2024-10-15 10:02:08,922+0000 DEBUG [org.jboss.as.jpa] (default task-3) default task-3:transaction scoped EntityManager [ejbca.ear#ejbca]: created entity manager session Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac150002:2e72c341:6707b644:12b14 status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2024-10-15 10:02:08,922+0000 DEBUG [org.jboss.as.jpa] (default task-3) default task-3:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac150002:2e72c341:6707b644:12b14 status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2024-10-15 10:02:08,922+0000 DEBUG [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (default task-3) appds: getConnection(null, WrappedConnectionRequestInfo@36619de8[userName=sa]) [0/150]
2024-10-15 10:02:08,922+0000 DEBUG [org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory] (default task-3) java.sql.Connection#beginRequest has been invoked
2024-10-15 10:02:08,923+0000 DEBUG [org.cesecore.config.CesecoreConfiguration] (default task-3) Using default value of 20 for new CA's ca.serialnumberoctetsize
2024-10-15 10:02:08,924+0000 DEBUG [org.cesecore.certificates.ca.CAData] (default task-3) CAData.getProtectString gives size: 11584
2024-10-15 10:02:08,924+0000 DEBUG [org.cesecore.config.CesecoreConfiguration] (default task-3) Using default value of 20 for new CA's ca.serialnumberoctetsize
2024-10-15 10:02:08,924+0000 DEBUG [org.cesecore.internal.CommonCacheBase] (default task-3) Update not needed X509CAImpl in cache. Digest was -229081066, cacheEntry digest was -229081066
2024-10-15 10:02:08,925+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Add CA certificates of CAs '-1296251422' to the PKI response message extraCerts field.
2024-10-15 10:02:08,925+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Get CA by ID: -1296251422
2024-10-15 10:02:08,925+0000 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-3) 2024-10-15 10:02:08+00:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;172.19.91.116;;;;resource0=/ca/-1296251422
2024-10-15 10:02:08,925+0000 DEBUG [org.cesecore.audit.log.InternalSecurityEventsLoggerSessionBean] (default task-3) LogDevice: Log4jDevice Proc: 0
2024-10-15 10:02:08,925+0000 DEBUG [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-3) CMP running on RA mode: false
2024-10-15 10:02:08,925+0000 DEBUG [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-3) CRMF request message (update) header has protection alg: 1.2.840.113549.1.1.11
2024-10-15 10:02:08,925+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.EndEntityCertificateAuthenticationModule] (default task-3) 1 certificate(s) found in the extraCert field in the CMP message
2024-10-15 10:02:08,926+0000 DEBUG [org.ejbca.core.ejb.ra.EndEntityAccessSessionBean] (default task-3) Looking for users with subjectdn: CN=TESTCMP, issuerdn : CN=TESTCMP
2024-10-15 10:02:08,926+0000 DEBUG [org.jboss.as.jpa] (default task-3) default task-3:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac150002:2e72c341:6707b644:12b14 status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2024-10-15 10:02:08,927+0000 DEBUG [org.ejbca.core.ejb.ra.EndEntityAccessSessionBean] (default task-3) Cannot find user with subjectdn: CN=TESTCMP, issuerdn : CN=TESTCMP
2024-10-15 10:02:08,927+0000 INFO [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-3) Error. Received a CMP KeyUpdateRequest for a non-existing end entity
2024-10-15 10:02:08,927+0000 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-3) 2024-10-15 10:02:08+00:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;cmpProtocolSignErrorResponse;;;;resource0=/ca/-1296251422
2024-10-15 10:02:08,927+0000 DEBUG [org.cesecore.audit.log.InternalSecurityEventsLoggerSessionBean] (default task-3) LogDevice: Log4jDevice Proc: 0
2024-10-15 10:02:08,928+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-3) Creating a signed error message with failInfo=2, failText=Error. Received a CMP KeyUpdateRequest for a non-existing end entity
2024-10-15 10:02:08,928+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpErrorResponseMessage] (default task-3) Create error message from requestType: 23
2024-10-15 10:02:08,928+0000 DEBUG [com.keyfactor.util.crypto.algorithm.AlgorithmTools] (default task-3) getSignAlgOidFromDigestAndKey: 1.2.840.113549.1.1.11
2024-10-15 10:02:08,928+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-3) Signature algorithm: SHA256WithRSA, from signAlg SHA256WithRSA, request digest 2.16.840.1.101.3.4.2.1 and key algorithm: RSA
2024-10-15 10:02:08,928+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-3) Selected signature alg oid: 1.2.840.113549.1.1.11, from signAlg SHA256WithRSA and key algorithm: RSA
2024-10-15 10:02:08,928+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-3) Signing CMP message with signature alg: SHA256WithRSA
2024-10-15 10:02:08,933+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-3) Received a response message of type 'org.ejbca.core.protocol.cmp.CmpErrorResponseMessage' from CmpMessageHandler.
2024-10-15 10:02:08,933+0000 DEBUG [org.jboss.as.jpa] (default task-3) default task-3:transaction scoped EntityManager [ejbca.ear#ejbca]: closing entity managersession
2024-10-15 10:02:08,933+0000 DEBUG [org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory] (default task-3) java.sql.Connection#endRequest has been invoked
2024-10-15 10:02:08,933+0000 DEBUG [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (default task-3) appds: returnConnection(50b8a15a, false) [0/150]
2024-10-15 10:02:08,933+0000 DEBUG [org.ejbca.ui.web.pub.ServletUtils] (default task-3) Adding Pragma header
2024-10-15 10:02:08,933+0000 DEBUG [org.ejbca.ui.web.pub.ServletUtils] (default task-3) Adding Cache-Control header
2024-10-15 10:02:08,933+0000 DEBUG [org.ejbca.ui.web.RequestHelper] (default task-3) Sent 2612 bytes to client
2024-10-15 10:02:08,933+0000 INFO [org.ejbca.ui.web.protocol.CmpServlet] (default task-3) Sent a CMP response to: 172.19.91.116, process time 13.

Can u help me in guiding how I can send renew certificate request in PKIMessage

1 reply

primetomas Oct 15, 2024
Maintainer

You have the errors:

2024-10-15 10:02:08,927+0000 DEBUG [org.ejbca.core.ejb.ra.EndEntityAccessSessionBean] (default task-3) Cannot find user with subjectdn: CN=TESTCMP, issuerdn : CN=TESTCMP
2024-10-15 10:02:08,927+0000 INFO [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-3) Error. Received a CMP KeyUpdateRequest for a non-existing end entity

A key update request must be tied to an existing enrollment because the old certificate is used to authorize the renewal. You can not create a renewal without an initial enrollment, and the renewal must match the subject and issuer of that. A client can not be a self-signed certificate as in your case (subjectdn: CN=TESTCMP, issuerdn : CN=TESTCMP)

pragyasandeep1998hal · 2024-10-16T11:18:50Z

pragyasandeep1998hal
Oct 16, 2024
Author

Now getting error:

Policy Tree: null
Subject Public Key: Sun RSA public key, 2048 bits
params: null
modulus: 23588343041100274943646051853936901487938575630642037181495145160589659752230962271434566300695608713756650716650111263009003774035299336245142825804496817109949517403069129341742897809703145894706810383876087205217805402855369744856377191551747750934587746100735109492168969646200136857382229653816149327049130273199821328871440378630983117505776225460024478408810707373208801921863278296534012831402464414485434759887141539670356040847353587786942398302802340215947346675461844165286594540967910018976377980411358348925982188897115517986262436220617314467296702096570063812133662291471168543060066057121869976223083
public exponent: 65537
]
2024-10-16 11:09:38,152+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.EndEntityCertificateAuthenticationModule] (default task-1) The certificate in extraCert is active
2024-10-16 11:09:38,152+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.EndEntityCertificateAuthenticationModule] (default task-1) Certificate does not belong to user. Username='null', extraCert username='RISHU'.
2024-10-16 11:09:38,152+0000 INFO [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-1) Failed to verify the signature in the PKIMessage
2024-10-16 11:09:38,153+0000 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-1) 2024-10-16 11:09:38+00:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;cmpProtocolSignErrorResponse;;;;resource0=/ca/-1535298494
2024-10-16 11:09:38,153+0000 DEBUG [org.cesecore.audit.log.InternalSecurityEventsLoggerSessionBean] (default task-1) LogDevice: Log4jDevice Proc: 0
2024-10-16 11:09:38,153+0000 DEBUG [org.cesecore.keys.token.CryptoTokenSessionBean] (default task-1) CryptoToken with ID -1557500643 will be checked for updates.
2024-10-16 11:09:38,153+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac150002:2e72c341:6707b644:16407 status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2024-10-16 11:09:38,153+0000 DEBUG [org.cesecore.internal.CommonCacheBase] (default task-1) Update not needed SoftCryptoToken in cache. Digest was 194783572, cacheEntry digest was 194783572
2024-10-16 11:09:38,153+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Creating a signed error message with failInfo=2, failText=Failed to verify the signature in the PKIMessage
2024-10-16 11:09:38,154+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpErrorResponseMessage] (default task-1) Create error message from requestType: 23
2024-10-16 11:09:38,154+0000 DEBUG [com.keyfactor.util.crypto.algorithm.AlgorithmTools] (default task-1) getSignAlgOidFromDigestAndKey: 1.2.840.113549.1.1.11
2024-10-16 11:09:38,154+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Signature algorithm: SHA256WithRSA, from signAlg SHA256WithRSA, request digest 2.16.840.1.101.3.4.2.1 and key algorithm: RSA
2024-10-16 11:09:38,154+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Selected signature alg oid: 1.2.840.113549.1.1.11, from signAlg SHA256WithRSA and key algorithm: RSA
2024-10-16 11:09:38,154+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Signing CMP message with signature alg: SHA256WithRSA
2024-10-16 11:09:38,159+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-1) Received a response message of type 'org.ejbca.core.protocol.cmp.CmpErrorResponseMessage' from CmpMessageHandler.
2024-10-16 11:09:38,159+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: closing entity managersession

0 replies

pragyasandeep1998hal · 2024-10-16T11:19:17Z

pragyasandeep1998hal
Oct 16, 2024
Author

Can u help me in fixing the issue

1 reply

primetomas Oct 16, 2024
Maintainer

Looks hard without taking over your code. The documentation, and RFC4210, provides all documentation. Getting into your code is too much work for volunteer work, at least for me.

Commercial plug: There is professional services available from Keyfactor.

Best regards,
Tomas

primetomas · 2024-10-16T11:58:22Z

primetomas
Oct 16, 2024
Maintainer

Oh, a revoked certificate would not be possible to renew with a KUR though, as the old certificate can not be validated. If a certificate is revoked, you always need to do a fresh enrollment. It lies in the definition of revoked, that it is not trusted anymore, and if not trusted it can not be used to authorize a renewal.

0 replies

pragyasandeep1998hal · 2024-10-16T12:54:09Z

pragyasandeep1998hal
Oct 16, 2024
Author

I tried to renew active certificate but Getting error:

2024-10-16 11:09:38,152+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.EndEntityCertificateAuthenticationModule] (default task-1) The certificate in extraCert is active
2024-10-16 11:09:38,152+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.EndEntityCertificateAuthenticationModule] (default task-1) Certificate does not belong to user. Username='null', extraCert username='RISHU'.
2024-10-16 11:09:38,152+0000 INFO [org.ejbca.core.protocol.cmp.CrmfKeyUpdateHandler] (default task-1) Failed to verify the signature in the PKIMessage

In which case this error occurs. Can u suggest any way to debug

1 reply

primetomas Oct 16, 2024
Maintainer

I suggest you run the sample openssl commands from the documentation. Then you can look at how the CMP messages are constructed doing that, and reproduce that with your code.

pragyasandeep1998hal · 2024-10-23T10:52:03Z

pragyasandeep1998hal
Oct 23, 2024
Author

I want to renew my certificate before it expires with same publickey but getting error:

           U.P.UTF8String 'User 'NAMAN' is not allowed to use same key as another certificate is using.'

Tell me how I can renew my certificate before it expires with same keypair

1 reply

primetomas Oct 23, 2024
Maintainer

There are two ways, depending on how you like your system to work.

Is this still using CMP?

There is a setting "Certificate renewal with same keys" in the CMP alias.

If you don't use the same end entity (username) as for initial enrollment, I don't think renewal will work. But, the error message you see originates from a setting in "Edit CA", "Enforce unique public keys", that you can uncheck if you are sure that's what you want to do.

pragyasandeep1998hal · 2024-10-24T04:20:22Z

pragyasandeep1998hal
Oct 24, 2024
Author

Yes I am using CMP. One more thing I want to clarify. As I tried to renew the certificate before it expires. I am not sure from rfc4210 in PKIBody which tag do I need to use tag 2 or tag 7.
cr [2] CertReqMessages, --Certification Req
kur [7] CertReqMessages, --Key Update Request

And in which case tag 7 is used.

1 reply

primetomas Oct 25, 2024
Maintainer

Renewal is done with KUR (7).

pragyasandeep1998hal · 2024-10-29T03:54:12Z

pragyasandeep1998hal
Oct 29, 2024
Author

Thanks for your confirmation. Now I can successfully Renewal certificate with KUR (7).

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Renew certificate #686

{{title}}

Replies: 9 comments 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Renew certificate #686

pragyasandeep1998hal Oct 10, 2024

Replies: 9 comments · 5 replies

primetomas Oct 10, 2024 Maintainer

pragyasandeep1998hal Oct 15, 2024 Author

primetomas Oct 15, 2024 Maintainer

pragyasandeep1998hal Oct 16, 2024 Author

pragyasandeep1998hal Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

primetomas Oct 16, 2024 Maintainer

pragyasandeep1998hal Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

pragyasandeep1998hal Oct 23, 2024 Author

primetomas Oct 23, 2024 Maintainer

pragyasandeep1998hal Oct 24, 2024 Author

primetomas Oct 25, 2024 Maintainer

pragyasandeep1998hal Oct 29, 2024 Author

pragyasandeep1998hal
Oct 10, 2024

Replies: 9 comments 5 replies

primetomas
Oct 10, 2024
Maintainer

pragyasandeep1998hal
Oct 15, 2024
Author

primetomas Oct 15, 2024
Maintainer

pragyasandeep1998hal
Oct 16, 2024
Author

pragyasandeep1998hal
Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer

primetomas
Oct 16, 2024
Maintainer

pragyasandeep1998hal
Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer

pragyasandeep1998hal
Oct 23, 2024
Author

primetomas Oct 23, 2024
Maintainer

pragyasandeep1998hal
Oct 24, 2024
Author

primetomas Oct 25, 2024
Maintainer

pragyasandeep1998hal
Oct 29, 2024
Author