Using SSCEP client with EJBCA #497

venkataravikumaralladi · 2024-02-08T11:19:43Z

venkataravikumaralladi
Feb 8, 2024

I have exploring SCEP protocol for enrollment usage with PKI infrastructure as EJBCA. For this I enabled SCEP in EJBCA community edition. I am using SSCEP (https://github.com/certnanny/sscep) as a client interface interacting with EJBCA.
Following are steps performed on ubuntu 22.04

Started EJBCA community docker. So now we have EJBCA server running.
Build and installed SSCEP client on ubuntu according to guidelines mentioned in document.
I have created SCEP Alias named as VRKSCEP as CA
To start with want to get ca certificate. I tried various commands like below but all failed.

./sscep getca -u http://localhost:443/ejbca/publicweb/apply/scep -c management.ca
cannot parse response
./sscep: error while sending message

./sscep getca -u http://localhost:443/ejbca/publicweb/apply/scep/VRKSCEP/pkiclient.ex -c ca.crt
cannot parse response
./sscep: error while sending message

./sscep getca -u http://localhost:443/ejbca/publicweb/apply/scep -c management.ca
cannot parse response
./sscep: error while sending message

I enabled debug logs

/sscep getca -u http://localhost:443/ejbca/publicweb/apply/scep -c ca.crt -v -d
./sscep: starting sscep, version 0.10.0
./sscep: new transaction
./sscep: transaction id: SSCEP transactionId
./sscep: hostname: localhost
./sscep: directory: ejbca/publicweb/apply/scep
./sscep: port: 443
./sscep: SCEP_OPERATION_GETCAPS
./sscep: scep request:
GET /ejbca/publicweb/apply/scep?operation=GetCACaps HTTP/1.1
Host: localhost:443
Connection: close

./sscep: connecting to localhost:443
cannot parse response

I am looking for help on how can we run command for getting ca cert. It seems response is not received. Thanks for your guidance

mike-agrenius-kushner · 2024-02-12T10:46:19Z

mike-agrenius-kushner
Feb 12, 2024
Maintainer

Hi,

From what I can tell, it doesn't look like your client is getting too far at all, much less into EJBCA – that said, are you seeing any logs at all on the EJBCA side?

Cheers,
Mike

0 replies

aleloco09 · 2024-03-03T09:45:17Z

aleloco09
Mar 3, 2024

Hello, I am having similar issues while using sscep.
In my EJBCA instance I have created two SCEP aliases called "PoliTO_SCEP_CA" (CA mode) and "PoliTO_SCEP_RA" (RA mode). For the second one I have associated a SubCA that supports RSA signing.
To test the connection I have downloaded the .crt certificates of a couple of active CAs, and run the following command:
sscep getca -u http://localhost:80/ejbca/publicweb/apply/scep/PoliTO_SCEP_CA/pkiclient.exe -c ./PoliTOSubCASCEP.crt -d
The response i get is:

sscep: starting sscep, version 0.6.1
sscep: new transaction
sscep: transaction id: SSCEP transactionId
sscep: hostname: localhost
sscep: directory: ejbca/publicweb/apply/scep/PoliTO_SCEP_CA/pkiclient.exe
sscep: port: 80
sscep: SCEP_OPERATION_GETCA
sscep: requesting CA certificate
sscep: scep msg: GET /ejbca/publicweb/apply/scep/PoliTO_SCEP_CA/pkiclient.exe?operation=GetCACert&message=CAIdentifier HTTP/1.0

sscep: server returned status code 404
sscep: mime_err: HTTP/1.1 404 Not Found
X-XSS-Protection: 1
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src https:
Date: Sun, 03 Mar 2024 09:28:04 GMT
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Content-Type: text/html;charset=UTF-8
Content-Length: 84

<html><head><title>Error</title></head><body>No CA certificates found.</body></html>
sscep: wrong (or missing) MIME content type
sscep: error while sending message

server side this is the response
ejbca | 2024-03-03 09:43:22,194+0000 INFO [org.ejbca.ui.web.protocol.ScepServlet] (default task-3) SCEP GetCACert request for unknown CA 'CAIdentifier'.
The same happens when testing the other PoliTO_SCEP_RA. I have tried with other CA's certificates (for instance ManagementCA) but it is always the same.
As you can see the connection is established but it is like it does not have any certificate (or it does not send?). Where is the problem?

1 reply

kyberpunk Sep 17, 2024

Got the same issue, workaround is described in unresolved sscep issue: certnanny/sscep#160

primetomas · 2024-03-04T10:18:52Z

primetomas
Mar 4, 2024
Maintainer

Hi,
see this issue it has been discussed and solved here:
#503

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Using SSCEP client with EJBCA #497

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 1 reply

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Using SSCEP client with EJBCA #497

venkataravikumaralladi Feb 8, 2024

Replies: 3 comments · 1 reply

mike-agrenius-kushner Feb 12, 2024 Maintainer

aleloco09 Mar 3, 2024

kyberpunk Sep 17, 2024

primetomas Mar 4, 2024 Maintainer

venkataravikumaralladi
Feb 8, 2024

Replies: 3 comments 1 reply

mike-agrenius-kushner
Feb 12, 2024
Maintainer

aleloco09
Mar 3, 2024

primetomas
Mar 4, 2024
Maintainer