Page History

...

CMPv2 client

Input Table for CMPV2 client

...

Currently the POC for CMPv2 client is working based on the inputs below.

Input Values	Input Type	Description	Usage
csrMeta	object	csrMeta object from aaf, would contain values needed for certificate request. any needed values that should be stored in the csrMeta will be mentioned below.	stores all pertinent values for certificate request - these will be detailed below, and should be set before being passed to the cmpv2 client.
csrMeta:IssuerDn	org.bouncycastle.asn1.x500.X500Name	distinguished name of the CA we're receiving certificate from. Cannot be null	used in the creation of the cert on EJBCA server
csrMeta: SubjectDn	org.bouncycastle.asn1.x500.X500Name	Distinguished name of the Entity the certificate is being issued to/ Certificate Requesting Entity. Cannot be null.	used in the creation of the cert on EJBCA server
csrMeta: KeyPair	java.security.KeyPair	KeyPair associated with the entity the certificate is being issued to. Cannot be null	used to create proof of possession for request to EJBCA server
csrMeta: Password	object which contains iak/rv?	secret password value shared by EJBCA server. Cannot be null	used to authenticate ourselves to the EJBCA serve
csrMeta: CA Details	object	Certification Authority Details ( Http address, Port number and Path (which includes alias if used)). Cannot be null	used to Post Http request to External CA.
.cer file	java.security.cert.X509Certificate	.cer (CSR) generated by Cert-man using Key-pair. Cannot be null.	used to validate response (.crt)/ certificate send from EJBCA server
caName	string	the name which is a general description of the external CA	used for debugging purposes
caMode	enum	string noting whether the server we are contacting will be operating in either client or RA mode	used for debugging purposes

Relevant values in Certificate Request message to EJBCA:

Value	Description	Information Included
PKIHeader	Contains information common to many PKI messages.	SenderDN IssuerDN ProtectionAlgorithm(used for PkiProtection below)
PKIBody	contains message-specific information ie. certificate request message	CertificateRequestMessage, which includes: SubjectDN IssuerDN SubjectPublicKey
PKIProtection	contains bits that protect PKImessage (Specifically the iak/rv)

Test code for running cmpv2 client against EJBCA server through unit test

@Test
    public void testServerWithRealUrl()
        throws CmpClientException {

        setValidCsrMetaValuesAndDateValues();

        csrMeta.externalCaUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmpSubRA");
        csrMeta.password("mypassword");

        CmpClientImpl cmpClient = new CmpClientImpl();
        try {
            cmpClient.createCertRequest("data", "RA", csrMeta, cert, notBefore, notAfter);
        } catch (CAOfflineException e) {
            e.printStackTrace();
        }
    }

    private void setValidCsrMetaValuesAndDateValues() {
        ArrayList<RDN> rdns = new ArrayList<>();
        try {
            rdns.add(new RDN("O=CommonCompany"));
        } catch (CertException e) {
            e.printStackTrace();
        }
        csrMeta = new CSRMeta(rdns);
        csrMeta.cn("Node123");
        csrMeta.san("CommonName.com");
        csrMeta.password("password");
        csrMeta.email("CommonName@cn.com");
        csrMeta.issuerCn("subCA");
        when(kpg.generateKeyPair()).thenReturn(keyPair);
        csrMeta.keypair(trans);
        csrMeta.externalCaUrl("http://127.0.0.1/ejbca/publicweb/cmp/cmp");

        try {
            notBefore =  Optional.ofNullable(new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2019/11/11 12:00:00"));
            notAfter =  Optional.ofNullable(new SimpleDateFormat("yyyy/MM/dd HH:mm:ss").parse("2020/11/11 12:00:00"));
        } catch (ParseException e) {
            e.printStackTrace();
        }
    }

...

Within you K8s workload add CertService's client as init container.:

Make sure you pass as ENV variables all required parameters.

...