Unable to Access WebAdmin UI #688

pkiman2 · 2024-10-15T13:54:59Z

pkiman2
Oct 15, 2024

Hi,

First of all, I wanted to thank this community for the great help. I ran into error after another error when I was installing EJBCA CE from scratch. However, I am still facing issues down to the last step and I couldn't find the answer from Q&A section. So I decided to post this.

I was able to install and deploy EJBCA and imported the superadmin.p12 to my computer. I can see on my cert store. However, when I pull up the admin web UI, I got this:

Logs:
Wildfly-server.10.14.2024.log
Wildfly-server.log

Any help and advice is much much appreciated. Thank you!

Answered by primetomas

Oct 16, 2024

It is not recommended to run WildFly as root. If you run "ant runinstall" as root, but do not run WildFly as root, the privileges on those files (check with ls -al) will not allow WildFly to read them.

We don't recommend running anything as root. We think it's is generally bad practice to run as root when not absolutely needed.

View full answer

primetomas · 2024-10-15T14:04:15Z

primetomas
Oct 15, 2024
Maintainer

look like you tried to access https://localhost:8080? or http://localhost:8443? I.e. http instead of https or something?

5 replies

pkiman2 Oct 15, 2024
Author

https:

http:

I built EJBCA CE on a Ubuntu VM, if that helps.

primetomas Oct 15, 2024
Maintainer

What browser is that? Did you try Firefox?

pkiman2 Oct 15, 2024
Author

I am using Brave. I downloaded and installed Firefox and I get this:

I can see the superadmin cert:

I'm wondering if there's a log somewhere aside from wildfly log that I check?

primetomas Oct 15, 2024
Maintainer

The request don't reach WildFly so you will not find anything there. This is on the TLS level.
Did you change any profile for the TLS server certificate? This can happen if you don't have serverAuthentication extended key usage for example.
Can you access https://hostname:8442/, i.e. TLS without client certificate authentication?

Or did you do any special configuration of cipher suites? What algorithms do you use for TLS server and superadmin?

pkiman2 Oct 15, 2024
Author

Couldn't also get in to port 8442:

Here's the set of config I used:
cesecore.properties

allow.external-dynamic.configuration=false
password.encryption.key=
password.encryption.count=100
ca.rngalgorithm=SHA1PRNG
ca.serialnumberoctetsize=20
certificate.validityoffset=-10m
securityeventsaudit.implementation.0=org.cesecore.audit.impl.log4j.Log4jDevice
securityeventsaudit.implementation.1=org.cesecore.audit.impl.integrityprotected.IntegrityProtectedDevice
securityeventsaudit.exporter.1=org.cesecore.audit.impl.AuditExporterXml

database.properties

datasource.jndi-name=EjbcaDS
database.name=mysql
database.url=jdbc:mysql://192.168.146.132:3306/ejbca?characterEncoding=UTF-8
database.driver=org.mariadb.jdbc.Driver
database.username=ejbca
database.password=ejbca

ejbca.properties

appserver.home=/opt/wildfly
ejbca.productionmode=true
allow.external-dynamic.configuration=false
ejbca.cli.defaultusername=ejbca
ejbca.cli.defaultpassword=ejbca

web.properties

java.trustpassword=
superadmin.cn=SuperAdmin
superadmin.dn=CN=${superadmin.cn}
superadmin.password=
superadmin.batch=true
httpsserver.password=
httpsserver.hostname=RootCA-Prod
httpsserver.dn=CN=${httpsserver.hostname},O=XYZ,C=US
httpsserver.tokentype=P12

install.properties

ca.name=XYZ-MCA
ca.dn=CN=XYZ-MCA,O=XYZ-INT,C=US
ca.tokentype=soft
ca.tokenpassword=null
ca.keytype=RSA
ca.keyspec=2048
ca.signaturealgorithm=SHA256WithRSA
ca.validity=3650
ca.policy=null

I am suspecting I should have selected one from these, in cesecore:

#authkeybind.ciphersuite.0=TLSv1.2;TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
#authkeybind.ciphersuite.1=TLSv1.2;TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
#authkeybind.ciphersuite.2=TLSv1.2;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
#authkeybind.ciphersuite.3=TLSv1.2;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
#authkeybind.ciphersuite.4=TLSv1.2;TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
#authkeybind.ciphersuite.5=TLSv1.2;TLS_RSA_WITH_AES_256_CBC_SHA256
#authkeybind.ciphersuite.6=TLSv1.2;TLS_RSA_WITH_AES_128_CBC_SHA
#authkeybind.ciphersuite.7=TLSv1;TLS_DHE_RSA_WITH_AES_256_CBC_SHA
#authkeybind.ciphersuite.8=TLSv1;TLS_RSA_WITH_AES_256_CBC_SHA
#authkeybind.ciphersuite.9=TLSv1;TLS_RSA_WITH_AES_128_CBC_SHA
#authkeybind.ciphersuite.10=TLSv1.3;TLS_AES_128_GCM_SHA256
#authkeybind.ciphersuite.11=TLSv1.3;TLS_AES_256_GCM_SHA384
#authkeybind.ciphersuite.12=TLSv1.3;TLS_CHACHA20_POLY1305_SHA256

Or these in web.properties

#The public port JBoss will listen to http on
#Default 8080
#httpserver.pubhttp=8080
#The public port JBoss will listen to https on, no client cert required
#Default 8442
#httpserver.pubhttps=8442
#The private port JBoss will listen to https on, client cert required
#Default 8443
#httpserver.privhttps=8443

Or could be something else.

primetomas · 2024-10-16T07:07:36Z

primetomas
Oct 16, 2024
Maintainer

authkeybinding doesn't have anything todo with this.

Why did you set httpsserver.password to empty?

It seems server keystores have not been generated. You have this in the log file. I would not be surprised if it is due to setting an empty password. P12 files need passwords.

2024-10-14 20:38:48,294 WARN [org.wildfly.extension.elytron] (MSC service thread 1-2) WFLYELY00023: KeyStore file '/opt/wildfly/standalone/configuration/keystore/truststore.p12' does not exist. Used blank.
2024-10-14 20:38:48,296 WARN [org.wildfly.extension.elytron] (MSC service thread 1-4) WFLYELY00023: KeyStore file '/opt/wildfly/standalone/configuration/keystore/keystore.p12' does not exist. Used blank.

13 replies

pkiman2 Oct 16, 2024
Author

Hi Tomas,

I forgot to add "" on httpsserver.password. It has a value.

Could this be the httpserver.privhttps=8443? It remained commented. If it is, should I rollback to clean slate and start over again (install wildfly, deploy, runinstall) ?

primetomas Oct 16, 2024
Maintainer

No you don't need to uncomment anything in web.properties actually. Btw, hostname is supposed to be the server hostname, i.e. the hostname you use in the URL when connecting. Typically all lower case "myhost.example.com".
I see the issuer server certificate in the log file, and can't see anything wrong with that. For some reason the p12 keystores were not created....OR

Check if the files /opt/wildfly/standalone/configuration/keystore/truststore.p12 and keystore.p12 exists.

Did you run ant runinstall as root so these can not be read by WildFly? Otherwise you should have had some error when running "ant runinstall" that it feiled to create these files. But privileges are not an uncommon issue.

pkiman2 Oct 16, 2024
Author

p12 files exist:

I executed ant runinstall as root. I used root to build the entire system, actually. Is that wrong? Tells me, BUILD SUCCESS. Here's the output:

root@XYZ-RootCA-Prod:/home/XYZ-admin/ejbca/ejbca-ce# ant runinstall
Buildfile: /home/XYZ-admin/ejbca/ejbca-ce/build.xml

customejbca.message:
[echo] No custom changes to merge.

runinstall:

check:bootstrapdone:

ejbca:prompt:
[input] skipping input as property ca.name has already been set.
[input] skipping input as property ca.dn has already been set.
[input] skipping input as property ca.keytype has already been set.
[input] skipping input as property ca.keyspec has already been set.
[input] skipping input as property ca.signaturealgorithm has already been set.
[input] skipping input as property ca.validity has already been set.
[input] skipping input as property ca.policy has already been set.
[echo] To set httpsserver.hostname you need to configure conf/web.properties. See sample config file conf/web.properties.sample.
[input] skipping input as property httpsserver.hostname has already been set.
[echo]
[echo] Common Name (CN) of httpsserver dn is by default taken from the httpsserver.hostname.
[input] skipping input as property httpsserver.dn has already been set.
[input] skipping input as property superadmin.cn has already been set.
[input] skipping input as property superadmin.dn has already been set.
[input] skipping input as property superadmin.batch has already been set.
[input] skipping input as property superadmin.password has already been set.
[input] skipping input as property ca.tokenpassword has already been set.

ejbca:deploytrustprompt:
[input] skipping input as property java.trustpassword has already been set.

ejbca:deployprompt:
[input] skipping input as property httpsserver.password has already been set.

ejbca:init:
[echo]
[echo] ------------------- CA Properties ----------------
[echo] ca.name : XYZ-INT-MCA
[echo] ca.dn : CN=XYZ-INT-MCA,O=XYZ-INT,C=US
[echo] ca.tokentype : soft
[echo] ca.keytype : RSA
[echo] ca.keyspec : 2048
[echo] ca.signaturealgorithm : SHA256WithRSA
[echo] ca.validity : 3650
[echo] ca.policy : null
[echo] ca.tokenproperties : ${ca.tokenproperties}
[echo] httpsserver.hostname : XYZ-RootCA-Prod
[echo] httpsserver.dn : CN=XYZ-RootCA-Prod,O=XYZ-INT,C=US
[echo] httpsserver.tokentype : P12
[echo] superadmin.cn : SuperAdmin
[echo] superadmin.dn : CN=SuperAdmin
[echo] superadmin.batch : true
[echo] appserver.home : /opt/wildfly
[echo]

ejbca:install:

ejbca:initCA:
[echo] Initializing CA with 'XYZ-INT-MCA' 'CN=XYZ-INT-MCA,O=XYZ-INT,C=US' 'soft' '<ca.tokenpassword hidden>' '2048' 'RSA''3650' 'null' 'SHA256WithRSA' -superadmincn 'SuperAdmin'...

ejbca:adminweb:
[echo] batch tomcat

ejbca:setclearpwd:

ejbca:batchsuperadmin:
[echo] batch superadmin

ejbca:deploytrustprompt:
[input] skipping input as property java.trustpassword has already been set.

ejbca:javatruststore:
[input] skipping input as property ca.name has already been set.
[echo] Getting root certificate in DER format...
[echo] ca getcacert "XYZ-INT-MCA" /tmp/rootca.der -der
[echo] Adding to or creating keystore: /home/XYZ-admin/ejbca/ejbca-ce/p12/truststore.p12

ejbca:javatruststore-removeold:
[exec] Certificate was added to keystore
[exec] [Storing /home/XYZ-admin/ejbca/ejbca-ce/p12/truststore.p12]
[delete] Deleting: /tmp/rootca.der

BUILD SUCCESSFUL
Total time: 55 seconds
root@XYZ-RootCA-Prod:/home/XYZ-admin/ejbca/ejbca-ce#

Here's for ant -q clean deployear:
root@XYZ-RootCA-Prod:/home/XYZ-admin/ejbca/ejbca-ce# ant -q clean deployear
[echo] No custom changes to merge.
[echo] Cleaning cesecore-x509ca
[echo] Cleaning va
[echo] Cleaning ra
[echo] appserver.home: /opt/wildfly
[echo] appserver.type: jboss
[echo] appserver.subtype: jboss7
[echo]
[echo] ---------- EJBCA 8.3.2 Enterprise (working copy) CONFIGURATION PROPERTIES ----------
[echo] appserver.type = jboss
[echo] appserver.subtype = jboss7
[echo] appserver.home = /opt/wildfly
[echo] java.version(ant.java) = 11.0.23 (11)
[echo] ocsp.signaturealgorithm = SHA256WithRSA;SHA256withRSAandMGF1;SHA384WithRSA;SHA512WithRSA;SHA224withECDSA;SHA256withECDSA;SHA384withECDSA;SHA512withECDSA;Ed25519;Ed448
[echo] datasource.jndi-name = EjbcaDS
[echo] datasource.jndi-name-prefix = java:/
[echo] database.name = mysql
[echo] database.url = jdbc:mysql://192.168.146.132:3306/ejbca?characterEncoding=UTF-8
[echo] database.driver = org.mariadb.jdbc.Driver
[echo] database.username = ejbca
[echo] database.password = ***
[echo] database.useSeparateCertificateTable = false
[echo] database.valid.connection.sql = select 1
[echo] mail.jndi-name = java:/EjbcaMail
[echo] mail.from = [email protected]
[echo] mail.user = ejbca_user
[echo] mail.password = ***
[echo] mail.smtp.host = localhost
[echo] mail.smtp.port = 25
[echo] mail.smtp.auth = false
[echo] mail.debug = false
[echo] httpserver.pubhttp = 8080
[echo] httpserver.pubhttps = 8442
[echo] httpserver.privhttps = 8443
[echo] httpserver.external.privhttps = 8443
[echo] httpsserver.hostname = XYZ-RootCA-Prod
[echo] httpsserver.password = ***
[echo] httpserver.external.fqdn =
[echo] web.contentencoding = UTF-8
[echo] ejbcaws.enabled = true
[echo] unidfnr.enabled = false
[echo]
[echo]
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use unchecked or unsafe operations.
[javac] Note: Recompile with -Xlint:unchecked for details.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/cesecore-entity/src/org/cesecore/roles/RoleInformation.java uses or overrides a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/cesecore-ejb/src/org/cesecore/authorization/AuthorizationSessionBean.java uses or overrides a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/cesecore-ejb/src/org/cesecore/certificates/ca/CaSessionBean.java usesunchecked or unsafe operations.
[javac] Note: Recompile with -Xlint:unchecked for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/healthcheck-war/src/org/ejbca/ui/web/pub/VaPeerStatusServlet.java uses unchecked or unsafe operations.
[javac] Note: Recompile with -Xlint:unchecked for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: Some input files use or override a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/ra-gui/src/org/ejbca/ra/jsfext/RaExceptionHandlerFactory.java uses oroverrides a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] warning: Implicitly compiled files were not subject to annotation processing.
[javac] Use -proc:none to disable annotation processing or -implicit to specify a policy for implicit compilation.
[javac] Note: /home/XYZ-admin/ejbca/ejbca-ce/modules/clientToolBox/src/org/ejbca/ui/cli/SCEPTest.java uses or overrides a deprecated API.
[javac] Note: Recompile with -Xlint:deprecation for details.
[javac] 1 warning
[javac] warning: Implicitly compiled files were not subject to annotation processing.
[javac] Use -proc:none to disable annotation processing or -implicit to specify a policy for implicit compilation.
[javac] 1 warning
[jar] JARs are never empty, they contain at least a manifest file
[echo] Using local documentation, if any. Set -Ddoc.update=true if you wish to update documentation from Confluence.
[echo] WS=/home/XYZ-admin/ejbca/ejbca-ce/modules/ejbca-ws/src/org/ejbca/core/protocol/ws/objects
[echo] Folder found: true
[echo] Local documentation is now available in file:///home/XYZ-admin/ejbca/ejbca-ce/tmp/htdocs/docs/index.html
[echo] in-test-mode: false
[echo] Enabled module doc.war
[echo] Enabled module ejbca-ws-ejb.jar
[echo] Disabled module systemtests-ejb.jar
[echo] Disabled module statedump-ejb.jar
[echo] Disabled module configdump-ejb.jar
[echo] Disabled module peerconnector-ejb.jar
[echo] Disabled module cesecore-cvcca.jar
[echo] Enabled module cesecore-x509ca.jar
[echo] Disabled module proxy-ca.jar
[echo] Disabled module unidfnr-ejb.jar
[echo] Disabled module peerconnector.rar
[echo] Disabled module peerconnector.war
[echo] Enabled module ra-gui.war
[echo] Disabled module acme.war
[echo] Disabled module msae.war
[echo] Disabled module cits.war
[echo] Disabled module est.war
[echo] Enabled module ejbca-rest-api.war
[echo] Disabled module swagger-ui.war
[echo] Disabled module ssh.war
[echo] Enabled module status.war
[echo] Enabled module certstore.war
[echo] Enabled module crlstore.war
[echo] Specify -Dsignjar.keystore=/path/keystore.jks if you want to sign the release.
[echo] Using appserver.home : /opt/wildfly
[echo] Task completed 2024-10-14 20:43:58 +0000.

BUILD SUCCESSFUL
Total time: 53 seconds

primetomas Oct 16, 2024
Maintainer

It is not recommended to run WildFly as root. If you run "ant runinstall" as root, but do not run WildFly as root, the privileges on those files (check with ls -al) will not allow WildFly to read them.

We don't recommend running anything as root. We think it's is generally bad practice to run as root when not absolutely needed.

Answer selected by pkiman2

pkiman2 Oct 16, 2024
Author

You're right. P12 files are only accessible by root:

I guess I have to do the entire thing again using a normal user for this. Thanks for all the help! I'll mark your previous answer once I completed a new build with success.

primetomas Oct 16, 2024
Maintainer

You can just change owner of everything and it should work
cd /op
sudo chown -R wildfly:wildfly wildfly

pkiman2 Oct 16, 2024
Author

Is this the expected output?
root@XYZ-RootCA-Prod:/opt# ls /opt
wildfly wildfly-26.0.0.Final
root@XYZ-RootCA-Prod:/opt# sudo chown -R wildfly:wildfly wildfly
root@XYZ-RootCA-Prod:/opt#
root@XYZ-RootCA-Prod:/opt# ls -al
total 12
drwxr-xr-x 3 root root 4096 Oct 15 04:26 .
drwxr-xr-x 20 root root 4096 May 15 20:15 ..
lrwxrwxrwx 1 wildfly wildfly 25 Oct 15 04:26 wildfly -> /opt/wildfly-26.0.0.Final
drwxr-xr-x 11 wildfly wildfly 4096 Dec 15 2021 wildfly-26.0.0.Final

After that, I checked the p12 files and they're still showing the same:

root@XYZ-RootCA-Prod:/opt/wildfly/standalone/configuration/keystore# ls -al
total 20
drwxr-xr-x 2 wildfly wildfly 4096 Oct 15 21:08 .
drwxr-xr-x 4 wildfly wildfly 4096 Oct 15 04:44 ..
-rw-r--r-- 1 wildfly wildfly 1593 Oct 15 04:38 credentials
-rw------- 1 root root 3627 Oct 15 21:08 keystore.p12
-rw------- 1 root root 1254 Oct 15 21:08 truststore.p12

primetomas Oct 16, 2024
Maintainer

If you have a symlink you need to "chown" the directory.

sudo chown -R wildfly:wildfly /opt/wildfly-26.0.0.Final

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to Access WebAdmin UI #688

{{title}}

Replies: 2 comments 18 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Unable to Access WebAdmin UI #688

pkiman2 Oct 15, 2024

Replies: 2 comments · 18 replies

primetomas Oct 15, 2024 Maintainer

pkiman2 Oct 15, 2024 Author

primetomas Oct 15, 2024 Maintainer

pkiman2 Oct 15, 2024 Author

primetomas Oct 15, 2024 Maintainer

pkiman2 Oct 15, 2024 Author

primetomas Oct 16, 2024 Maintainer

pkiman2 Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

pkiman2 Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

pkiman2 Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

pkiman2 Oct 16, 2024 Author

primetomas Oct 16, 2024 Maintainer

pkiman2
Oct 15, 2024

Replies: 2 comments 18 replies

primetomas
Oct 15, 2024
Maintainer

pkiman2 Oct 15, 2024
Author

primetomas Oct 15, 2024
Maintainer

pkiman2 Oct 15, 2024
Author

primetomas Oct 15, 2024
Maintainer

pkiman2 Oct 15, 2024
Author

primetomas
Oct 16, 2024
Maintainer

pkiman2 Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer

pkiman2 Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer

pkiman2 Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer

pkiman2 Oct 16, 2024
Author

primetomas Oct 16, 2024
Maintainer