Nabble - EjbCA

EJBCA 3.7.0 released

2008-08-28T08:18:33Z

We are very proud to release this first version of EJBCA with EU EAC
ePassport support. This means support for CVC certificates, which are
very different from X.509 certificates.

This is a major release, particularly focusing on support for CVC
certificates as used in EU EAC ePassport PKI.
Read the changelog for details.

Notable changes in no specific order:
- Support for CV Certificates (CVC) for EU EAC ePassports, you can now
build a CVC PKI for EU ePassport using EJBCA.
- Upgrade of jaxb jars using for Webservice API, and new WS-API calls.
- Support for error codes in Exceptions from Webservice API.
- New service to automatically renew expiring CAs.
- Possible to use IAIK PKCS#11 provider as well as Sun PKCS#11.
- Client Tool box with client CLI tools easy to deploy stand-alone on
other machines.
- Minor fixes and enhancements.

For upgrade instructions, please see UPGRADE.
There are no database upgrades in this release.

Because there are binary files in EJBCA_HOME/lib changed there is no
patch file for upgrading
EJBCA 3.6.x to 3.7.0. Use the full package from EJBCA 3.7.0 and follow
the upgrade instructions in UPGRADE.

Changes:
-------
New Feature
* [ECA-792] - Support for CV Certificates (CVC) for EU EAC ePassports
* [ECA-811] - Possible to create certificate request from any CA
* [ECA-825] - WS-API call to get users last cert and chain
* [ECA-827] - Service to renew CAs
* [ECA-830] - Possible to use IAIK PKCS#11 provider instead of Sun
* [ECA-920] - Client tool box.

Improvement
* [ECA-819] - New WS-API call to get EJBCA version
* [ECA-871] - Enhance error management in EJBCA web services.
* [ECA-893] - Able to use TelephoneNumber and PostalAddress in DN and
publish to LDAP attributes
* [ECA-915] - Display hostname on admin-GUI
* [ECA-923] - Use of EEP informations when using WS editUser.
* [ECA-929] - Handle error code if certificate revocation has been
invoked twice.

Bug
* [ECA-813] - Upgraded profiles not saved until edited
* [ECA-829] - Advanced mode for log viewer is not working
* [ECA-832] - syscheck script sc_08_crl_from_web.sh shell problem
* [ECA-839] - Problem activating CA tokens for expired CAs
* [ECA-879] - Failure to create a new CA due to CRL creation failure
* [ECA-921] - EjbcaHealthCheck does not work on OC4J
* [ECA-924] - Language variable misspelled (name="UTF8")

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-news mailing list
Ejbca-news@...
https://lists.sourceforge.net/lists/listinfo/ejbca-news

From forum: EjbCA - News

EJBCA 3.7.0 released

2008-08-28T08:18:33Z

We are very proud to release this first version of EJBCA with EU EAC
ePassport support. This means support for CVC certificates, which are
very different from X.509 certificates.

This is a major release, particularly focusing on support for CVC
certificates as used in EU EAC ePassport PKI.
Read the changelog for details.

Notable changes in no specific order:
- Support for CV Certificates (CVC) for EU EAC ePassports, you can now
build a CVC PKI for EU ePassport using EJBCA.
- Upgrade of jaxb jars using for Webservice API, and new WS-API calls.
- Support for error codes in Exceptions from Webservice API.
- New service to automatically renew expiring CAs.
- Possible to use IAIK PKCS#11 provider as well as Sun PKCS#11.
- Client Tool box with client CLI tools easy to deploy stand-alone on
other machines.
- Minor fixes and enhancements.

For upgrade instructions, please see UPGRADE.
There are no database upgrades in this release.

Because there are binary files in EJBCA_HOME/lib changed there is no
patch file for upgrading
EJBCA 3.6.x to 3.7.0. Use the full package from EJBCA 3.7.0 and follow
the upgrade instructions in UPGRADE.

Changes:
-------
New Feature
* [ECA-792] - Support for CV Certificates (CVC) for EU EAC ePassports
* [ECA-811] - Possible to create certificate request from any CA
* [ECA-825] - WS-API call to get users last cert and chain
* [ECA-827] - Service to renew CAs
* [ECA-830] - Possible to use IAIK PKCS#11 provider instead of Sun
* [ECA-920] - Client tool box.

Improvement
* [ECA-819] - New WS-API call to get EJBCA version
* [ECA-871] - Enhance error management in EJBCA web services.
* [ECA-893] - Able to use TelephoneNumber and PostalAddress in DN and
publish to LDAP attributes
* [ECA-915] - Display hostname on admin-GUI
* [ECA-923] - Use of EEP informations when using WS editUser.
* [ECA-929] - Handle error code if certificate revocation has been
invoked twice.

Bug
* [ECA-813] - Upgraded profiles not saved until edited
* [ECA-829] - Advanced mode for log viewer is not working
* [ECA-832] - syscheck script sc_08_crl_from_web.sh shell problem
* [ECA-839] - Problem activating CA tokens for expired CAs
* [ECA-879] - Failure to create a new CA due to CRL creation failure
* [ECA-921] - EjbcaHealthCheck does not work on OC4J
* [ECA-924] - Language variable misspelled (name="UTF8")

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: Question about EJB interfaces

2008-08-27T23:55:56Z

Bouncycastle have plans for FIPS evaluation. There's no time schedule
for this yet however.

Regards,
Tomas

Johan Eklund wrote:

> Hi Gabriel,
>
> Great to hear that you are interested in EJBCA! First of all I want to
> state that I'm an EJBCA core developer so I'm very partial in this issue
> and the only time I've been into contact with parts of Dogtag was when I
> tried to borrow their Autoenrollment-proxy for MS Autoenroll, which I
> never got to work properly. (The developer at Red Hat was very helpful,
> so I have nothing bad to say about them.)
>
> I'm not sure Dogtag is stable enough for a production environment, since
> the one of the prerequisites is Fedora 8. A CA can live up to 10 years,
> so you want to be able to get security updates during that entire time
> for your platform. I think Red Hat has a Certificate Service running on
> Red Hat Linux is better suited for this.
>
> Comparing the features of Dogtag
> (http://pki.fedoraproject.org/wiki/PKI_Main_Page), RHCS
> (http://www.redhat.com/certificate_system/) and EJBCA
> (http://www.ejbca.org/features.html), I think the first two looks very
> limited. This however might not be a bad thing if you only need the very
> basics and don't need additional features in the future.
>
> EJBCA run on any platform where Java is available using any of numerous
> databases and Hardware Security Modules (HSMs).
>
> "Red Hat Certificate System uses FIPS 140-2 Level 2-validated security
> libraries and can be used with Level 3-validated hardware." It's
> obviously not the entire application that is certified and the hardware
> (HSM) is always certified. EJBCA uses the well known (but not yet
> certified to my knowledge) http://bouncycastle.org/java.html library. I
> know a version of EJBCA is undergoing a certification process and I can
> return with more info on this later.
>
> EJBCA is used by a very large number of users worldwide, but
> unfortunately most of them don't want this to be known publicly. A list
> of some of them can be found at http://www.ejbca.org/installations.html.
> I did not see any list for RHCS or Dogtag.
>
> EJBCA is very configurable so, if you tell us a little more about the
> purpose of the CA, scale of the project and security requirements we can
> give you a better view of what EJBCA can do for you. (Feel free to
> contact "info at primkey dot se" if you don't want to disclose this
> information on a public mailinglist.)
>
> I hope this gets you started, even though (like I said) I'm very
> partial.. =)
>
> Best Regards,
> Johan Eklund
>
>
> Gabriel França Campolina skrev:
>> Hi Folks,
>> My boss send me compare some software that implements a PKI(CA,RA and
>> infrastructure), I view many commercial options but EJBCA and DogTag
>> is the best option that i find, I was view the DogTag have the FIPS
>> 101-1 level 2 certification and this is a point of decision to he,
>> about this certification EJBCA have some preview about this?And what
>> advantages of EJBCA about dogtag that you know?
>>
>> Sorry about my english, i speak portuguese...
>>
>> Thanks,
>>
>>
>>
>>
>>
>> 2008/8/23 Tomas Gustavsson <tomas@... <mailto:tomas@...>>
>>
>>
>> If you want to use the EJB interface the command line interface
>> are very
>> good examples to look at.
>>
>> Check out the files in src/java/org/ejbca/ui/cli.
>>
>> Regards,
>> Tomas
>>
>> Gabriel França Campolina wrote:
>> > Hi Folks,
>> > I,m a new list user, I,d like congraturarions all developer that
>> create
>> > this good project. I was set the EJBCA in my job, and i,d like
>> know what
>> > the principal interfaces/classes in EJB Session Beans that i can
>> use to
>> > comunicate with the EJBCA via remote, I want access the methods
>> more
>> > use: create certificate, add User,remove user revogate
>> certificate etc
>> >
>> > Thanks,
>> >
>> >
>> >
>>
>> ------------------------------------------------------------------------
>> >
>> >
>>
>> -------------------------------------------------------------------------
>> > This SF.Net email is sponsored by the Moblin Your Move
>> Developer's challenge
>> > Build the coolest Linux based applications with Moblin SDK & win
>> great prizes
>> > Grand prize is a trip for two to an Open Source event anywhere
>> in the world
>> > http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> <http://moblin-contest.org/redirect.php?banner_id=100&url=/>
>> >
>> >
>> >
>>
>> ------------------------------------------------------------------------
>> >
>> > _______________________________________________
>> > Ejbca-develop mailing list
>> > Ejbca-develop@...
>> <mailto:Ejbca-develop@...>
>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>>
>>
>> -------------------------------------------------------------------------
>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>> challenge
>> Build the coolest Linux based applications with Moblin SDK & win
>> great prizes
>> Grand prize is a trip for two to an Open Source event anywhere in
>> the world
>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> <http://moblin-contest.org/redirect.php?banner_id=100&url=/>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejbca-develop@...
>> <mailto:Ejbca-develop@...>
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>>
>> ------------------------------------------------------------------------
>>
>> -------------------------------------------------------------------------
>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>> challenge
>> Build the coolest Linux based applications with Moblin SDK & win great
>> prizes
>> Grand prize is a trip for two to an Open Source event anywhere in the
>> world
>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejbca-develop@...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: Question about EJB interfaces

2008-08-27T14:26:23Z

Hi Gabriel,

Great to hear that you are interested in EJBCA! First of all I want to
state that I'm an EJBCA core developer so I'm very partial in this issue
and the only time I've been into contact with parts of Dogtag was when I
tried to borrow their Autoenrollment-proxy for MS Autoenroll, which I
never got to work properly. (The developer at Red Hat was very helpful,
so I have nothing bad to say about them.)

I'm not sure Dogtag is stable enough for a production environment, since
the one of the prerequisites is Fedora 8. A CA can live up to 10 years,
so you want to be able to get security updates during that entire time
for your platform. I think Red Hat has a Certificate Service running on
Red Hat Linux is better suited for this.

Comparing the features of Dogtag
(http://pki.fedoraproject.org/wiki/PKI_Main_Page), RHCS
(http://www.redhat.com/certificate_system/) and EJBCA
(http://www.ejbca.org/features.html), I think the first two looks very
limited. This however might not be a bad thing if you only need the very
basics and don't need additional features in the future.

EJBCA run on any platform where Java is available using any of numerous
databases and Hardware Security Modules (HSMs).

"Red Hat Certificate System uses FIPS 140-2 Level 2-validated security
libraries and can be used with Level 3-validated hardware." It's
obviously not the entire application that is certified and the hardware
(HSM) is always certified. EJBCA uses the well known (but not yet
certified to my knowledge) http://bouncycastle.org/java.html library. I
know a version of EJBCA is undergoing a certification process and I can
return with more info on this later.

EJBCA is used by a very large number of users worldwide, but
unfortunately most of them don't want this to be known publicly. A list
of some of them can be found at http://www.ejbca.org/installations.html.
I did not see any list for RHCS or Dogtag.

EJBCA is very configurable so, if you tell us a little more about the
purpose of the CA, scale of the project and security requirements we can
give you a better view of what EJBCA can do for you. (Feel free to
contact "info at primkey dot se" if you don't want to disclose this
information on a public mailinglist.)

I hope this gets you started, even though (like I said) I'm very
partial.. =)

Best Regards,
Johan Eklund

Gabriel França Campolina skrev:

> Hi Folks,
> My boss send me compare some software that implements a PKI(CA,RA and
> infrastructure), I view many commercial options but EJBCA and DogTag
> is the best option that i find, I was view the DogTag have the FIPS
> 101-1 level 2 certification and this is a point of decision to he,
> about this certification EJBCA have some preview about this?And what
> advantages of EJBCA about dogtag that you know?
>
> Sorry about my english, i speak portuguese...
>
> Thanks,
>
>
>
>
>
> 2008/8/23 Tomas Gustavsson <tomas@... <mailto:tomas@...>>
>
>
> If you want to use the EJB interface the command line interface
> are very
> good examples to look at.
>
> Check out the files in src/java/org/ejbca/ui/cli.
>
> Regards,
> Tomas
>
> Gabriel França Campolina wrote:
> > Hi Folks,
> > I,m a new list user, I,d like congraturarions all developer that
> create
> > this good project. I was set the EJBCA in my job, and i,d like
> know what
> > the principal interfaces/classes in EJB Session Beans that i can
> use to
> > comunicate with the EJBCA via remote, I want access the methods more
> > use: create certificate, add User,remove user revogate
> certificate etc
> >
> > Thanks,
> >
> >
> >
> ------------------------------------------------------------------------
> >
> >
> -------------------------------------------------------------------------
> > This SF.Net email is sponsored by the Moblin Your Move
> Developer's challenge
> > Build the coolest Linux based applications with Moblin SDK & win
> great prizes
> > Grand prize is a trip for two to an Open Source event anywhere
> in the world
> > http://moblin-contest.org/redirect.php?banner_id=100&url=/
> <http://moblin-contest.org/redirect.php?banner_id=100&url=/>
> >
> >
> >
> ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejbca-develop@...
> <mailto:Ejbca-develop@...>
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> <http://moblin-contest.org/redirect.php?banner_id=100&url=/>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> <mailto:Ejbca-develop@...>
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

--
PrimeKey Solutions offers a commercial EJBCA support subscription and training for EJBCA. Please see www.primekey.se or contact info@... for more information. http://download.primekey.se/documents/ejbca_subscription.pdf http://download.primekey.se/documents/ejbca_training.pdf

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

smime.p7s (3K) Download Attachment

From forum: EjbCA - Dev

Re: Question about EJB interfaces

2008-08-27T12:10:12Z

Hi Folks,
My boss send me compare some software that implements a PKI(CA,RA and infrastructure), I view many commercial options but EJBCA and DogTag is the best option that i find, I was view the DogTag have the FIPS 101-1 level 2 certification and this is a point of decision to he, about this certification EJBCA have some preview about this?And what advantages of EJBCA about dogtag that you know?

Sorry about my english, i speak portuguese...

Thanks,

2008/8/23 Tomas Gustavsson <tomas@...>

If you want to use the EJB interface the command line interface are very
good examples to look at.

Check out the files in src/java/org/ejbca/ui/cli.

Regards,
Tomas

Gabriel França Campolina wrote:
> Hi Folks,
> I,m a new list user, I,d like congraturarions all developer that create
> this good project. I was set the EJBCA in my job, and i,d like know what
> the principal interfaces/classes in EJB Session Beans that i can use to
> comunicate with the EJBCA via remote, I want access the methods more
> use: create certificate, add User,remove user revogate certificate etc
>
> Thanks,
>
>

> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: Question about CRL updater service

2008-08-25T08:03:57Z

Thank you!
It's always good to read the doc, hehe. So, it's wise not to have an overlap time shorter than the CRL updater period.

Tack så mycket!

El Lunes, 25 de Agosto de 2008 16:21:48 Johan Eklund escribió:

> Hola Miguel!
>
> http://www.ejbca.org/manual.html#CRL%20generation has a pretty nice
> description of this.
>
> You are right about the assumption that no CRL will be generated in this
> case. Increase the CRL Overlap time or the intensity of the CRL updater.
> If you have a lot of certificates you will also have to take into
> account the time it takes to generate the CRL.
>
> Best Regards,
> Johan
>
> Miguel Angel Tormo Alfaro skrev:
> > Hi all, I have a little question regarding periodic CRL issuing...
> > What effect can the parameter 'CRL overlap time' that can be set editing a CA have to the CRL updater service?
> > Imagine that the CRL overlap time is set to 10 minutes, and the CRL updater service has a 30 minutes period.
> > So, if the CRL is going to expire at 3:30 for example, and the CRL updater is executed at 3:19, will the CRL updater service issue a CRL because it's about to expire before the next check or will the fact there is not enough time yet to cover the overlap time prevent the generation of a new CRL?
> >
> > Thanks!
> >
> > -------------------------------------------------------------------------
> > This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> > Build the coolest Linux based applications with Moblin SDK & win great prizes
> > Grand prize is a trip for two to an Open Source event anywhere in the world
> > http://moblin-contest.org/redirect.php?banner_id=100&url=/
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejbca-develop@...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>

From forum: EjbCA - Dev

Re: Question about CRL updater service

2008-08-25T07:20:13Z

Hola Miguel!

http://www.ejbca.org/manual.html#CRL%20generation has a pretty nice
description of this.

You are right about the assumption that no CRL will be generated in this
case. Increase the CRL Overlap time or the intensity of the CRL updater.
If you have a lot of certificates you will also have to take into
account the time it takes to generate the CRL.

Best Regards,
Johan

Miguel Angel Tormo Alfaro skrev:

> Hi all, I have a little question regarding periodic CRL issuing...
> What effect can the parameter 'CRL overlap time' that can be set editing a CA have to the CRL updater service?
> Imagine that the CRL overlap time is set to 10 minutes, and the CRL updater service has a 30 minutes period.
> So, if the CRL is going to expire at 3:30 for example, and the CRL updater is executed at 3:19, will the CRL updater service issue a CRL because it's about to expire before the next check or will the fact there is not enough time yet to cover the overlap time prevent the generation of a new CRL?
>
> Thanks!
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

smime.p7s (3K) Download Attachment

From forum: EjbCA - Dev

Question about CRL updater service

2008-08-25T07:02:09Z

Hi all, I have a little question regarding periodic CRL issuing...
What effect can the parameter 'CRL overlap time' that can be set editing a CA have to the CRL updater service?
Imagine that the CRL overlap time is set to 10 minutes, and the CRL updater service has a 30 minutes period.
So, if the CRL is going to expire at 3:30 for example, and the CRL updater is executed at 3:19, will the CRL updater service issue a CRL because it's about to expire before the next check or will the fact there is not enough time yet to cover the overlap time prevent the generation of a new CRL?

Thanks!

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T03:45:19Z

i am in a very small environment and someday i will upgrade.

JonB

On 25/08/2008, at 12.43, Tomas Gustavsson wrote:

>
> PS: In EJBCA 3.5.8 (end 3.6.2 off-course) there are several
> enhancements
> to the CRL generation service. They should only be needed when
> operating
> in a high load environment however, if you have 100's of thousands of
> certificates ni your databas so CRL generation may take a long time.
>
> /Tomas
>
>
> Jon Bendtsen wrote:
>> On 25/08/2008, at 12.08, Tomas Gustavsson wrote:
>>
>>> I guess you have configured Apache or something to use CRLs? Since
>>> JBoss/EJBCA will not deny anything because a CRL is not generated.
>>
>> apache
>>
>>
>>> Your CRL settings look good. Are you sure it's that the CRLs is not
>>> generated (in the database) and not that Apache has not understood
>>> there
>>> is a new CRL (since you have to reload apache whan CRLs are
>>> updated)?
>>
>> i have a cronscript that downloads a new crl and restarts apache.
>> I ran it by hand, and it didnt make any difference. The CRL it got
>> from ejbca was the same as the one it already downloaded last
>> time. The cronscript runs every 5 minutes.
>>
>>
>>> Your crl settings means that the CRL service will check every 5
>>> minutes
>>> if a new CRL needs to be generated. And it should generate a new one
>>> every 24 hours.
>>> If the CRL service for some reason would fail, you should get error
>>> messages in server.log in JBoss.
>>
>> I suppose i can go look.
>>
>>
>>
>> JonB
>>
>> -------------------------------------------------------------------------
>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>> challenge
>> Build the coolest Linux based applications with Moblin SDK & win
>> great prizes
>> Grand prize is a trip for two to an Open Source event anywhere in
>> the world
>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejbca-develop@...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T03:43:21Z

PS: In EJBCA 3.5.8 (end 3.6.2 off-course) there are several enhancements
to the CRL generation service. They should only be needed when operating
in a high load environment however, if you have 100's of thousands of
certificates ni your databas so CRL generation may take a long time.

/Tomas

Jon Bendtsen wrote:

> On 25/08/2008, at 12.08, Tomas Gustavsson wrote:
>
>> I guess you have configured Apache or something to use CRLs? Since
>> JBoss/EJBCA will not deny anything because a CRL is not generated.
>
> apache
>
>
>> Your CRL settings look good. Are you sure it's that the CRLs is not
>> generated (in the database) and not that Apache has not understood
>> there
>> is a new CRL (since you have to reload apache whan CRLs are updated)?
>
> i have a cronscript that downloads a new crl and restarts apache.
> I ran it by hand, and it didnt make any difference. The CRL it got
> from ejbca was the same as the one it already downloaded last
> time. The cronscript runs every 5 minutes.
>
>
>> Your crl settings means that the CRL service will check every 5
>> minutes
>> if a new CRL needs to be generated. And it should generate a new one
>> every 24 hours.
>> If the CRL service for some reason would fail, you should get error
>> messages in server.log in JBoss.
>
> I suppose i can go look.
>
>
>
> JonB
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T03:36:00Z

On 25/08/2008, at 12.08, Tomas Gustavsson wrote:

>
> I guess you have configured Apache or something to use CRLs? Since
> JBoss/EJBCA will not deny anything because a CRL is not generated.

apache

> Your CRL settings look good. Are you sure it's that the CRLs is not
> generated (in the database) and not that Apache has not understood
> there
> is a new CRL (since you have to reload apache whan CRLs are updated)?

i have a cronscript that downloads a new crl and restarts apache.
I ran it by hand, and it didnt make any difference. The CRL it got
from ejbca was the same as the one it already downloaded last
time. The cronscript runs every 5 minutes.

> Your crl settings means that the CRL service will check every 5
> minutes
> if a new CRL needs to be generated. And it should generate a new one
> every 24 hours.
> If the CRL service for some reason would fail, you should get error
> messages in server.log in JBoss.

I suppose i can go look.

JonB

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T03:08:59Z

I guess you have configured Apache or something to use CRLs? Since
JBoss/EJBCA will not deny anything because a CRL is not generated.

Your CRL settings look good. Are you sure it's that the CRLs is not
generated (in the database) and not that Apache has not understood there
is a new CRL (since you have to reload apache whan CRLs are updated)?

Your crl settings means that the CRL service will check every 5 minutes
if a new CRL needs to be generated. And it should generate a new one
every 24 hours.
If the CRL service for some reason would fail, you should get error
messages in server.log in JBoss.

/Tomas

Jon Bendtsen wrote:

> Hi
>
> Yeah i knew i forgot to mention alot of details, amoung others version
> 3.5.3
>
> In the web admin system under EDIT SERVICES , i enabled a CRL updater
> which is active. And it just updated, but maybe i dont understand the
> timings?
>
> period is 5 minutes.
>
> under Edit Certificate Authorities and this particular CA
>
> CRL Expire Period (Hours) 48
> CRL Issue Interval (Hours) 24
> CRL Overlap Time (Minutes) 60
>
>
> So, now the CRL is working again, but this being the 2. critical time
> i needed
> to login and was rejected because the CRL was too old, i need to fix
> it permanently.
>
>
>
> JonB
>
>
> On 25/08/2008, at 11.15, Tomas Gustavsson wrote:
>
>> Which method are you using? Are you using the CRL Updater service?
>>
>> /Tomas
>>
>>
>> Jon Bendtsen wrote:
>>> Hi
>>>
>>> Occasionally my ejbca setup doesnt generate a new CRL. It's rather
>>> annoying because then i cant log in.
>>>
>>>
>>>
>>> JonB
>>>
>>> -------------------------------------------------------------------------
>>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>>> challenge
>>> Build the coolest Linux based applications with Moblin SDK & win
>>> great prizes
>>> Grand prize is a trip for two to an Open Source event anywhere in
>>> the world
>>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>>> _______________________________________________
>>> Ejbca-develop mailing list
>>> Ejbca-develop@...
>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> -------------------------------------------------------------------------
>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>> challenge
>> Build the coolest Linux based applications with Moblin SDK & win
>> great prizes
>> Grand prize is a trip for two to an Open Source event anywhere in
>> the world
>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejbca-develop@...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T02:40:55Z

Hi

Yeah i knew i forgot to mention alot of details, amoung others version
3.5.3

In the web admin system under EDIT SERVICES , i enabled a CRL updater
which is active. And it just updated, but maybe i dont understand the
timings?

period is 5 minutes.

under Edit Certificate Authorities and this particular CA

CRL Expire Period (Hours) 48
CRL Issue Interval (Hours) 24
CRL Overlap Time (Minutes) 60

So, now the CRL is working again, but this being the 2. critical time
i needed
to login and was rejected because the CRL was too old, i need to fix
it permanently.

JonB

On 25/08/2008, at 11.15, Tomas Gustavsson wrote:

>
> Which method are you using? Are you using the CRL Updater service?
>
> /Tomas
>
>
> Jon Bendtsen wrote:
>> Hi
>>
>> Occasionally my ejbca setup doesnt generate a new CRL. It's rather
>> annoying because then i cant log in.
>>
>>
>>
>> JonB
>>
>> -------------------------------------------------------------------------
>> This SF.Net email is sponsored by the Moblin Your Move Developer's
>> challenge
>> Build the coolest Linux based applications with Moblin SDK & win
>> great prizes
>> Grand prize is a trip for two to an Open Source event anywhere in
>> the world
>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejbca-develop@...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: no new CRL gets generated?

2008-08-25T02:15:44Z

Which method are you using? Are you using the CRL Updater service?

/Tomas

Jon Bendtsen wrote:

> Hi
>
> Occasionally my ejbca setup doesnt generate a new CRL. It's rather
> annoying because then i cant log in.
>
>
>
> JonB
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

no new CRL gets generated?

2008-08-25T02:11:57Z

Hi

Occasionally my ejbca setup doesnt generate a new CRL. It's rather
annoying because then i cant log in.

JonB

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Branch for EJBCA 3.7

2008-08-23T00:27:34Z

Today we have made a branch for EJBCA 3.7 (Branch_3_7).
EJBCA 3.7, focusing on EU EAC ePassport PKI, is to be released in the
coming days.

Svn trunk is open and will continue forward to EJBCA 3.8.

Regards,
Tomas

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: Question about EJB interfaces

2008-08-23T00:16:37Z

If you want to use the EJB interface the command line interface are very
good examples to look at.

Check out the files in src/java/org/ejbca/ui/cli.

Regards,
Tomas

Gabriel França Campolina wrote:

> Hi Folks,
> I,m a new list user, I,d like congraturarions all developer that create
> this good project. I was set the EJBCA in my job, and i,d like know what
> the principal interfaces/classes in EJB Session Beans that i can use to
> comunicate with the EJBCA via remote, I want access the methods more
> use: create certificate, add User,remove user revogate certificate etc
>
> Thanks,
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev

Re: Question about EJB interfaces

2008-08-22T07:41:14Z

Hello Gabriel,

Im glad to hear EJBCA pleases you! The things you mention can be done
using the web interface if you want.
You can find some information about it at
http://ejbca.sourceforge.net/manual.html#EJBCA%20Web%20Service%20Interface

Best regards,
Tham Wickenberg

Gabriel França Campolina wrote:

> Hi Folks,
> I,m a new list user, I,d like congraturarions all developer that
> create this good project. I was set the EJBCA in my job, and i,d like
> know what the principal interfaces/classes in EJB Session Beans that i
> can use to comunicate with the EJBCA via remote, I want access the
> methods more use: create certificate, add User,remove user revogate
> certificate etc
>
> Thanks,
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

From forum: EjbCA - Dev

Question about EJB interfaces

2008-08-22T07:17:34Z

Hi Folks,
I,m a new list user, I,d like congraturarions all developer that create this good project. I was set the EJBCA in my job, and i,d like know what the principal interfaces/classes in EJB Session Beans that i can use to comunicate with the EJBCA via remote, I want access the methods more use: create certificate, add User,remove user revogate certificate etc

Thanks,

From forum: EjbCA - Dev

EJBCA 3.6.2 released

2008-08-20T01:20:21Z

After lots of work 3.6.2 is now released.

This is a minor release but with a record amount of fixes for a point
release. New features, improvements and a lot of bugfixes
rounding a lot of rough edges.

Some very notable changes are:

- Major improvements to the External OCSP responder with more
configuration options and
completely new Audit and Account logging. With the new, highly
configurable, logging it is
suitable for using as a service charging for, and auditing, requests.
- New documentation feature with on-line documentation deployed in the
Web interface by default.
Question mark links from options that are hard to understand in the
Admin-GUI are now possible.
- Lots of improvements to the Admin-GUI with configuration for
autogenerated passwords and fixing a lot of small GUI bugs and quirks.
- Fail over mechanism for the LDAP publisher.
- Improved documentation for more HSMs, Admin-GUI, etc.
- Improvements for other app servers apart from JBoss.
- MS document signing extended key usage, and tool for importing
certificates from MS CA.
- Lots and lots of small bugfixes.
- Updated translations.

Read the changelog for details.

This is a plug-in upgrade from 3.6.x. See UPGRADE for the simple
instructions.

Changes
-------
New Feature
* [ECA-348] - Option to generate non-exportable private keys in IE
* [ECA-739] - Accounting log on OCSP responder
* [ECA-740] - When requiring signed OCSP request, configure allowed issuers
* [ECA-865] - Add tool for importing certificates from a MS CA
* [ECA-876] - Generated documentation should be reachable from within
the EJBCA Web GUI
* [ECA-908] - Support MS document signing extended key usage
* [ECA-914] - Configure if OCSP responses should use KeyId or Name as
ResponderId

Improvement
* [ECA-390] - Make it possible to select password generation parameters
for autogenerated user password
* [ECA-547] - Send custom certificate publisher information found in
certificate or CRL.
* [ECA-640] - Popup window with valid ${Foo} variables near any field in
which they can be used
* [ECA-657] - Import and export of end entity profiles should not have
to depend on existing CAs.
* [ECA-696] - Import profiles improvement.
* [ECA-760] - Relocate 'p12' to 'ejbca-custom' if/when present (by default)
* [ECA-765] - Log whenever an attempt to activate a CA with the wrong
activation code is made
* [ECA-789] - Display issuer in listcas cli command
* [ECA-790] - ejbcarawscli should print error message if it can not find
the admin keystore
* [ECA-795] - Notifications are not editable, but looks editable.
* [ECA-810] - Make advanced search for ProtectedLog available
* [ECA-822] - Default healthcheck db query causes table scan
* [ECA-826] - EjbcaWsHelper makes double allocations when looking up
remote beans
* [ECA-833] - Simple LDAPPublisher failover
* [ECA-854] - Remove confusing error message about not finding
ejbca-custom directory when running ant
* [ECA-859] - Delta CRL generation message
* [ECA-870] - Accept PEM certificates with BEGIN TRUSTED CERTIFICATE
* [ECA-872] - Improve public page for CA certificate retrieval
* [ECA-874] - General JUint test improvements
* [ECA-880] - Better defaults and help for Freshest CRL Extension /
DeltaCRLs
* [ECA-881] - Be able to drop the 0, O, l and 1 from the auto generated
passwords
* [ECA-884] - Add approvalDN variables to add/edit end entity notifications
* [ECA-885] - Add email variables where possible for use in notifications
* [ECA-887] - Document how validity is assigned for a CA
* [ECA-913] - Configure if OCSP responses should include whoe cert chain
or only signer

Task
* [ECA-702] - JDK 1.6 u4 causes EjbcaWS to stop working
* [ECA-796] - Add documentation on how to use EJBCA with GemSAFE Toolbox
* [ECA-805] - Update German translation

Bug
* [ECA-496] - When using a fixed Certificate Profile as template, the
FIXED property is inherited.
* [ECA-682] - WS Cli error message is not good when it cannot find the
.jks file
* [ECA-770] - Protected Log Device always sends 'missing row' email
alerts when it shouldn't with MySQL using InnoDB
* [ECA-783] - During the last step if IE enroll, the URL-path is missing
the "ejbca"-part.
* [ECA-788] - Bull TrustWay support
* [ECA-793] - Using of module protected keys with netHSM-500 failed
* [ECA-797] - Cannot activate a CA with a Safenet Luna SA Token.
* [ECA-798] - A card key or a soft key must be defined in order to run
the P11 external OCSP responder.
* [ECA-802] - Exception when approving KeyRecovery
* [ECA-803] - PKCS10 requests from OCSP responder uses null attributes
* [ECA-806] - Equal error code contants in OCSPUnidResponse
* [ECA-809] - ocsp cli client can not sign requests
* [ECA-812] - EJBCA 3.6 does not deploy on Glassfish
* [ECA-815] - NullpointerException downloading CA certificated without CN
* [ECA-817] - Possible NullpointerException when no extended information
exists for user
* [ECA-820] - Signing CMP responses does not work with most PKCS#11 HSMs
* [ECA-823] - Deadlock in ProtectedLogData with stresstest
* [ECA-824] - CA activation page does not display correct for Expired CAs
* [ECA-831] - High load on ProtectedLog might generate false alarm on MySQL
* [ECA-836] - Email notifications are not able to handle autogenerated
passwords.
* [ECA-837] - PKCS10 with no attributes causes NullPointer exception
* [ECA-841] - ExtRA PKCS12 request does not work with approvals
* [ECA-843] - Some words not localizables in CA Activation
* [ECA-850] - CN name like 'Graham O'Regan' cannot be entered case
sensitive in the 'Add Administrator'
* [ECA-851] - No messages are created during CA Activation
* [ECA-861] - Misdirected error output from "ra listusers" CLI to
standard output
* [ECA-866] - Import of externally chained PEM failes
* [ECA-875] - Trying to reset Subject AltName or Email for a end entity
fails
* [ECA-888] - Profiles allow you to enter things like 'Peter & Partners'
in the O and OU field - but a 'Add Entity' will fail
* [ECA-889] - NPE when running TestEjbcaWS
* [ECA-895] - Batch generation doesn't work on initial user creation
(WebUI / profiles)
* [ECA-898] - Incorrect initialization of NumberArray in
EndEntityProfile causes annoying log output
* [ECA-901] - email modified in LDAP even if attributes should not be
modified
* [ECA-902] - LdapSearchPublisher can not modify attributes
* [ECA-903] - LdapSearchPublisher uses Ldap DN instead of Cert DN to search
* [ECA-905] - java.lang.NullPointerException when creating new end
entity with only end time, with end entity profile limitations enabled
* [ECA-909] - OCSP responder not working on Weblogic
* [ECA-911] - OCSP not responding for CAs that have been notified about
expiration
* [ECA-912] - NPE on Glassfish on error.jsp in publiweb

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-news mailing list
Ejbca-news@...
https://lists.sourceforge.net/lists/listinfo/ejbca-news

From forum: EjbCA - News

EJBCA 3.6.2 released

2008-08-20T01:20:21Z

After lots of work 3.6.2 is now released.

This is a minor release but with a record amount of fixes for a point
release. New features, improvements and a lot of bugfixes
rounding a lot of rough edges.

Some very notable changes are:

- Major improvements to the External OCSP responder with more
configuration options and
completely new Audit and Account logging. With the new, highly
configurable, logging it is
suitable for using as a service charging for, and auditing, requests.
- New documentation feature with on-line documentation deployed in the
Web interface by default.
Question mark links from options that are hard to understand in the
Admin-GUI are now possible.
- Lots of improvements to the Admin-GUI with configuration for
autogenerated passwords and fixing a lot of small GUI bugs and quirks.
- Fail over mechanism for the LDAP publisher.
- Improved documentation for more HSMs, Admin-GUI, etc.
- Improvements for other app servers apart from JBoss.
- MS document signing extended key usage, and tool for importing
certificates from MS CA.
- Lots and lots of small bugfixes.
- Updated translations.

Read the changelog for details.

This is a plug-in upgrade from 3.6.x. See UPGRADE for the simple
instructions.

Changes
-------
New Feature
* [ECA-348] - Option to generate non-exportable private keys in IE
* [ECA-739] - Accounting log on OCSP responder
* [ECA-740] - When requiring signed OCSP request, configure allowed issuers
* [ECA-865] - Add tool for importing certificates from a MS CA
* [ECA-876] - Generated documentation should be reachable from within
the EJBCA Web GUI
* [ECA-908] - Support MS document signing extended key usage
* [ECA-914] - Configure if OCSP responses should use KeyId or Name as
ResponderId

Improvement
* [ECA-390] - Make it possible to select password generation parameters
for autogenerated user password
* [ECA-547] - Send custom certificate publisher information found in
certificate or CRL.
* [ECA-640] - Popup window with valid ${Foo} variables near any field in
which they can be used
* [ECA-657] - Import and export of end entity profiles should not have
to depend on existing CAs.
* [ECA-696] - Import profiles improvement.
* [ECA-760] - Relocate 'p12' to 'ejbca-custom' if/when present (by default)
* [ECA-765] - Log whenever an attempt to activate a CA with the wrong
activation code is made
* [ECA-789] - Display issuer in listcas cli command
* [ECA-790] - ejbcarawscli should print error message if it can not find
the admin keystore
* [ECA-795] - Notifications are not editable, but looks editable.
* [ECA-810] - Make advanced search for ProtectedLog available
* [ECA-822] - Default healthcheck db query causes table scan
* [ECA-826] - EjbcaWsHelper makes double allocations when looking up
remote beans
* [ECA-833] - Simple LDAPPublisher failover
* [ECA-854] - Remove confusing error message about not finding
ejbca-custom directory when running ant
* [ECA-859] - Delta CRL generation message
* [ECA-870] - Accept PEM certificates with BEGIN TRUSTED CERTIFICATE
* [ECA-872] - Improve public page for CA certificate retrieval
* [ECA-874] - General JUint test improvements
* [ECA-880] - Better defaults and help for Freshest CRL Extension /
DeltaCRLs
* [ECA-881] - Be able to drop the 0, O, l and 1 from the auto generated
passwords
* [ECA-884] - Add approvalDN variables to add/edit end entity notifications
* [ECA-885] - Add email variables where possible for use in notifications
* [ECA-887] - Document how validity is assigned for a CA
* [ECA-913] - Configure if OCSP responses should include whoe cert chain
or only signer

Task
* [ECA-702] - JDK 1.6 u4 causes EjbcaWS to stop working
* [ECA-796] - Add documentation on how to use EJBCA with GemSAFE Toolbox
* [ECA-805] - Update German translation

Bug
* [ECA-496] - When using a fixed Certificate Profile as template, the
FIXED property is inherited.
* [ECA-682] - WS Cli error message is not good when it cannot find the
.jks file
* [ECA-770] - Protected Log Device always sends 'missing row' email
alerts when it shouldn't with MySQL using InnoDB
* [ECA-783] - During the last step if IE enroll, the URL-path is missing
the "ejbca"-part.
* [ECA-788] - Bull TrustWay support
* [ECA-793] - Using of module protected keys with netHSM-500 failed
* [ECA-797] - Cannot activate a CA with a Safenet Luna SA Token.
* [ECA-798] - A card key or a soft key must be defined in order to run
the P11 external OCSP responder.
* [ECA-802] - Exception when approving KeyRecovery
* [ECA-803] - PKCS10 requests from OCSP responder uses null attributes
* [ECA-806] - Equal error code contants in OCSPUnidResponse
* [ECA-809] - ocsp cli client can not sign requests
* [ECA-812] - EJBCA 3.6 does not deploy on Glassfish
* [ECA-815] - NullpointerException downloading CA certificated without CN
* [ECA-817] - Possible NullpointerException when no extended information
exists for user
* [ECA-820] - Signing CMP responses does not work with most PKCS#11 HSMs
* [ECA-823] - Deadlock in ProtectedLogData with stresstest
* [ECA-824] - CA activation page does not display correct for Expired CAs
* [ECA-831] - High load on ProtectedLog might generate false alarm on MySQL
* [ECA-836] - Email notifications are not able to handle autogenerated
passwords.
* [ECA-837] - PKCS10 with no attributes causes NullPointer exception
* [ECA-841] - ExtRA PKCS12 request does not work with approvals
* [ECA-843] - Some words not localizables in CA Activation
* [ECA-850] - CN name like 'Graham O'Regan' cannot be entered case
sensitive in the 'Add Administrator'
* [ECA-851] - No messages are created during CA Activation
* [ECA-861] - Misdirected error output from "ra listusers" CLI to
standard output
* [ECA-866] - Import of externally chained PEM failes
* [ECA-875] - Trying to reset Subject AltName or Email for a end entity
fails
* [ECA-888] - Profiles allow you to enter things like 'Peter & Partners'
in the O and OU field - but a 'Add Entity' will fail
* [ECA-889] - NPE when running TestEjbcaWS
* [ECA-895] - Batch generation doesn't work on initial user creation
(WebUI / profiles)
* [ECA-898] - Incorrect initialization of NumberArray in
EndEntityProfile causes annoying log output
* [ECA-901] - email modified in LDAP even if attributes should not be
modified
* [ECA-902] - LdapSearchPublisher can not modify attributes
* [ECA-903] - LdapSearchPublisher uses Ldap DN instead of Cert DN to search
* [ECA-905] - java.lang.NullPointerException when creating new end
entity with only end time, with end entity profile limitations enabled
* [ECA-909] - OCSP responder not working on Weblogic
* [ECA-911] - OCSP not responding for CAs that have been notified about
expiration
* [ECA-912] - NPE on Glassfish on error.jsp in publiweb

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Ejbca-develop mailing list
Ejbca-develop@...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

From forum: EjbCA - Dev