I installed EJBCA with WildFly 10.1.10 Finally recently to evaluate the product. I feel the interface is good. But I encountered some issue about how to export and import certificates in EJBCA. After finishing setup EJBCA I tried to create some root CA and SubCA. It can create successfully. But I tried to export and import certificate either via JBoss CLI or Admin GUI. It failed. I checked my configuration (install.conf under ejbca). It use SoftCryptoToken. When I checked the CA or SubCA information, at the bottom it shows "This CA’s Crypto Token does not support and/or allow export."

I also tried to issue command according to EJBCA website https://www.ejbca.org/docs/Managing_CAs.html#src-26776579_id-.ManagingCAsv7.0.0-UsingCommandLineInterfaceUsing_command_line_interface

$ bin/ejbca.sh ca exportca TestCA ./TestCA.p12 Using JBoss JNDI provider... Enter keystore password: foo123

Then below error message pop up after entering keystore password.

Setting SignatureKeyAlias to SignatureKeyAlias Setting EncryptionAlias to EncryptionKeyAlias Enter keystore password: .....

Exception in thread "main" javaex.ejb.EJBException: org.cesecore.keys.token.PrivateKeyNotExtractableException: Crypto Token -2060058108 does not allow to extract private keys....

If root CA and SubCA and other certificates can't be backup and restore. Then when it needs to migrate or install to new CA server, then it can't use. Other than that I tried to download the CA root cert then delete it and import CA cert via Web UI, but it doesn't have crypto token, I created crypto token manually and activate via command line but also failed. I know EJBCA can use HSM to use hardware crypto token but I use soft crypto token.

So anyone knows how to solve it by modifying the configurations ? I think importing/exporting certificates are important.

Best Regards, Tom Cheung

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.