`
yangzb
  • 浏览: 3502756 次
  • 性别: Icon_minigender_1
  • 来自: 北京
社区版块
存档分类
最新评论

EJBCA Quick start guide

阅读更多

Quick start guide

Prerequisites

Note
EJBCA makes use of strong crypto and keystore passwords longer than 7 characters. For this to work you must install the 'Unlimited Strength Jurisdiction Policy Files' for JDK. The policy files can be found at the same place as the JDK download at java.sun.com. The text "Using exportable cryptography" is shown on the first page in the Admin GUI if you fail to install this package. Further information on this can be found in the Sun documentation on the JCE.
Note
The default, and easiest, installation is done on JBoss. EJBCA can however also run on Glassfish, Weblogic and OC4J. If you want to deploy on these application servers, read the section for your application server below. You mileage may vary on other appservers than JBoss, which is the most well supported.

Needed to build and run are:

  • JDK 1.5.x or 1.6.x (support for 1.4.x was dropped in EJBCA 3.5).
  • Unlimited Strength Jurisdiction Policy Files for your JDK
  • JBOSS >=4.2.x (support for JBoss 4.0.x was dropped in EJBCA 3.8).
  • Ant >= 1.6.5 to build (http://jakarta.apache.org/ant/)

Note that JBoss 5 contains bugs not present in JBoss 4. EJBCA works on some version of JBoss 5 but not others. Therefore we recommend the latest version of JBoss 4 for running EJBCA.

Set the environment variable APPSRV_HOME to the directory where the appservers root is (/jboss-version). This is done so the compile process will find JEE jar files, and the deploy script will know where files are to be copied on JBoss. On JBoss they are by default copied to the directory $APPSRV_HOME/server/default/deploy.

Windows/Unix: When we describe command line commands below we use unix notation, e.g. 'ejbca.sh' for the executable command files. The same command files are available for windows as cmd-files, e.g. 'ejbca.cmd.'

Java 1.6.0
Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6.0
http://java.sun.com/javase/downloads/index.jsp

Java 1.5.0
Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0
http://java.sun.com/j2se/1.5.0/download.jsp

NOTE: If you are unsure what version of EJBCA you are running, type 'ant ejbcaversion' in the EJBCA_HOME directory. (EJBCA 3.5 and newer.)

Configure

Note
If you are only testing EJBCA at this stage and is not setting up a production environment, you can skip this step. There are default configuration options, that should work in a test environment, for everything.
*** Configuration files ***

The configuration of EJBCA that can not be configured in the admin GUI is located in properties files in the conf directory. All properties are documented in sample files and to configure an option you copy the sample file, for example copy conf/ejbca.properties.sample to conf/ejbca.properties and configure conf/ejbca.properties . You should at least familiarize your self with the options in conf/ejbca.properties . Most options, except those related to the AdminCA can be changed after installation.

*** EJBCA configuration ***

1) Copy conf/ejbca.properties.sample to conf/ejbca.properties and customize if needed. The default values works fine for a test installation.

 

  • Customize the CA properties if you need to do so. For production use you need to do this, don't forget to edit passwords to be secure and secret. Keep conf/ejbca.properties as secret as possible. DO NOT forget the passwords, if you need to re-install the software sometime.
  • To use a hard ca token from start change ca.tokentype, ca.tokenpassword and ca.tokenproperties. You also need to add the appropriate values to the ca.tokenproperties file for the HSM. Read the HSM documentation for the right values.
  • To put the initial superadmin certificate on a smartcard, set superadmin.batch=false in web.properties. Enroll from public web after the installation is complete, as you would with any other smartcard user. Username is "superadmin" and password is superadmin.password from web.properties.
  • If you are deploying on JBoss EAP you probably want to look at the property 'jboss.config' as well, since 'production' is the default server to start on JBoss EAP.
Do the same with other configuration files that you might want to customize. The default values often works fine and is a safe bet if you are unsure. Most options are well documented in the sample files.
  • Customize the database in conf/database.properties if needed. But easiest thing is to keep the default as it is, it will use the JBoss embedded HSQLDB and everything will be easier for you. For production use you should use a real database instead of the embedded one.
*** Memory configuration ***

The memory parameters for Java is by default configured very low, for JBoss it is set by default to allow a maximum memory usage of 512mb, which is sufficient for most configurations. We still recommend that you check your configuration of java memory arguments to set them to at least '-Xms128m -Xmx512m'. For JBoss this is done in APPSRV_HOME/bin/run.conf where the line:

JAVA_OPTS="-server -Xms128m -Xmx512m"

can be changed.

*** Considerations ***

When everything is prepared, there are a few things to configure before starting your applications and running everything in a production environment.

In a production environment you should use something like the following structure:

  1. Go through the install process creating an AdminCA. Use a simple DN. This CA should only used to issue the administrator certificates. Not published in LDAP. If you want to use an HSM for this CA, see the documentation in the configuration file conf/ejbca.properties.sample.
  2. Once installed, create all your REAL CAs using the admin-GUI. Now you can use the certificate profiles etc that you like. These certificates can be published in LDAP. See doc/howto/HOWTO-multiplecas.txt for example of a detailed configuration guide.

In a production environment you should use something else than the default Hypersonic database that comes with JBoss for the reasons:

  1. Hypersonic database is in-memory, which means that over time it will consume more memory. If a large number of certificates is issued, it will become an issue after a while.
  2. Hypersonic does not support full SQL, in particular ALTER statements. When a new version of EJBCA is released we can not create scripts that updates the database if some tables changed. This will make upgrades much much harder.

For information about installing JDBC drivers for other databases, see the document 'doc/howto/HOWTO-database.txt' in the distribution.

Install

Note that the installation must be done with a user with privileges to write to APPSRV_HOME and subdirs.

1) Set the environment variable APPSRV_HOME to where your JBoss is installed, example:

APPSRV_HOME=/opt/jboss-4.2.3

Also make sure the right java tools (javac/keytool) are available in your system PATH, ie. /usr/local/jdk1.5.0_11/bin.
Due to Javas memory handling you mey need to assign more memory to ant in order to build the system without OutOfMemory errors. You can do that by setting an environment variable:

ANT_OPTS=-Xmx512m
Note
JBoss 5.x has a bug causing issues with the BC JCE provider when the Sun JVM is used. To work around this you can copy the files EJBCA_HOME/lib/bc*.jar to JBOSS_HOME/server/default/lib/. Remember this when it's time for upgrades!
JBoss 5.x also has a bug with multiple mail configurations. If you will be using mail notifications see conf/mail.properties.sample for configuration instructions.

2) Open a console and type:

ant bootstrap

it will compile, jar, war, ear everything and deploy it to JBoss.

3) Open a console (terminal) and start JBoss. You can start JBoss with the normal command 'run.sh/cmd' from APPSRV_HOME/bin. You should see JBoss picking up everything and deploying the ear without errors.

4) Type:

ant install

it will generate all certificates, keys, etc needed to run with an initial CA. You will find admin keys in ${ejbca.home}/p12. (do not delete those files!)
The command 'ant install' is only run once, when the CA is first installed. It creates lots of things in the database, and can not be run again (it will give an error if you try).

  • tomcat.jks is for the servlet container (don't bother with it)
  • truststore.jks is for the servlet container (don't bother with it)
  • superadmin.p12 should be imported in your browser, that's your administration certificate.
Note
Instead of creating an initial Admin CA and issuing administrator certificates from that, you can install using administrator certificates from an already existing external CA. See Administrators issued by external CAs for more information. This would replace step 4-8, but instead require other steps.

5) Stop JBoss (ctrl+c or whatever)

6) Type:

ant deploy

this will deploy everything again and configure the servlet container with the keystore file (this is why we needed to stop the container).

7) Import the certificate from EJBCA_HOME/p12/superadmin.p12 in your web browser. This is the super administrators certificate used to access the admin GUI. Other administrators with specific privileges can be created later on. The default password for superadmin.p12 is ejbca, and is configured in ejbca.properties.

8) Start JBoss again and go to https://localhost:8443/ejbca/ to access the admin-GUI, or http://localhost:8080/ejbca for the public pages.

If you create other CAs that you want to add as acceptable CAs in the SSL server configuration, or if you renew the CA certificate, you can install any CA certificate in the SSL server configuration afterwards with the following command:

ant -Dca.name="My CA Name" javatruststore

What this does in the background is that it adds the CA certificate to p12/truststore.jks and copies this file to JBOSS_HOME/server/default/conf/keystore, where the SSL keystores are located.

You must stop and start JBoss after doing this.

Using JBoss/Tomcat native SSL connector

Instead of the regular Tomcat SSL connector you can configure to use the native connector, which is supposed to improve performance.

See documentation in src/appserver/jboss/tomcat60 (if using JBoss 4.2.3) or src/appserver/tomcat60jboss5 (if using JBoss 5).

Additional howtos

In the directory doc/howto in the distribution there are additional howtos for some specific platforms and configurations.

Application servers

EJBCA can currently be run on JBoss (covered above), Glassfish (Sun AS), Weblogic, OC4J (Oracle AS) and Websphere.
(Websphere is not really supported, it's only one old version of EJBCA on one version of Websphere) .

Glassfish

Currently EJBCA works both with Glassfish v1 and v2 with the Derby/JavaDB database.

Don't forget to install 'Unlimited Strength Jurisdiction Policy Files' for Java.

*** Configure EJBCA ***

 

  1. Set the environment variable APPSRV_HOME to the directory where Glassfish is installed. For example APPSRV_HOME=/home/sun/glassfish. The variable must be available when working with EJBCA.
  2. Edit conf/ejbca.properties, you should at least set appserver.type, appserver.home and logging.log4j.config.
  3. Edit conf/database.properties, you should at least set datasource.jndi-name-prefix, and the database settings for your chosen database. Derby is supported for Glassfish, and default options for Derby should work.
  4. Edit conf/web.properties, you should set desired values and also the http/s ports (default 8080 and 8181) for your installation.
  5. Configuration of ejbcaws and xkms only have to be done in Glassfish v1.
    On Glassfish v2 it deploys nicely, even though the functionality does not work completely.
    See https://jira.primekey.se/browse/ECA-607 for details.
    (Tips how to solve these probles are welcome.)
    • Edit conf/jaxws.properties and set 'ejbcaws.enabled=false'.
    • Edit conf/xkms.properties and set 'xkms.enabled=false'. (Default from EJBCA 3.10.)
Build ejbca with 'ant'.
Do 'ant clean' first if you have tried with different appservers, or database settings.
*** Configure Glassfish ***

 

  1. Do yourself a favor and configure this in the JVM settings of Glassfish v1 (default in v2):
    -XX:MaxPermSize=192m
    Restart Glassfish
  2. Derby:
    1. Start the database: asadmin start-database.
    2. Create a database and a database user with privileges.
        > cd /home/sun/glassfish/bin
        > export DERBY_HOME=/home/sun/glassfish/javadb; ../javadb/bin/ij   
         (For glassfish v1 use this command instead: 
          > export DERBY_HOME=/home/sun/glassfish/javadb; ../javadb/frameworks/NetworkServer/bin/ij.ksh)
      
        ij> connect 'jdbc:derby://localhost:1527/ejbca;create=true';
        ij> run '/home/sun/ejbca/doc/howto/create-tables-ejbca3-derby.sql';
        ij> quit;
      
  3. Start the application server: asadmin start-domain
    The default user/password for the web console is admin/adminadmin.
    Access the Glassfish admin console at http://127.0.0.1:4848/.
  4. Create a connection pool for your database. In the admin console this is done in Resources->JDBC->Connection Pools.
    When adding a Derby Pool use values: Name=EjbcaPool, Type=javax.sql.DataSource, Vendor=JavaDB.
    Properties: user=APP, password=APP, DatabaseName=ejbca
  5. Create a datasource called jdbc/EjbcaDS, in the admin console this is done in Resources->JDBC->JDBC Resources.
    Use the connection pool you just created.
*** Deploy and setup ***

 

  1. Deploy ejbca.ear using:
    ./asadmin deploy ../../ejbca/dist/ejbca.ear
    The relative path to ejbca.ear depends on where you installed ejbca and glassfish. You can check that everything was ok in domains/domain1/logs/server.log.
  2. Install ejbca:
    ant install
  3. Configure SSL in Glassfish
    Configuration->HTTP Service->HTTP Listeners->http-listener-2, SSL tab
    • Client Authentication: Enabled
    • Certificate Nickname: s1as (get alias name by running 'keytool -list -v -keystore $APPSRV_HOME/domains/domain1/config/keystore.jks', password changeit)
    • SSL3: Enabled
    • Ciphers Suite: All
    Add CA certificate to cacerts file:
    • cd $EJBCA_HOME
    • bin/ejbca.sh ca getrootcert AdminCA1 ca.der -der
    Install the CA certificate in the application servers truststore.
    On Glassfish open source:
    • keytool -import -keystore $APPSRV_HOME/domains/domain1/config/cacerts.jks -file $EJBCA_HOME/ca.der
    • password is 'changeit'
    On Glassfish Enterprise:
    • cd $APPSRV_HOME/domains/domain1/config
    • /usr/sfw/bin/certutil -A -n adminca1 -t "p,p,p" -i $EJBCA_HOME/ca.der -d .
    • verify that adminca1 has been added to the store with '/usr/sfw/bin/certutil -L -d .'.
    Restart server
    (you would probably want to install your own server certificate from $EJBCA_HOME/p12/tomcat.jks instead of the default Glassfish cert, to do this you must edit both the http-listener and the IIOP-listeners. You can also generate a new $APPSRV_HOME/domains/domain1/config/keystore.jks with key alias s1as, or even easier change the alias in tomcat.jks with keytool -changealias)
  4. Access protected EJBCA pages
    Import $EJBCA_HOME/p12/superadmin.p12 in your browser and go to url:
    https://127.0.0.1:8181/ejbca/
    You can now click "Administration" to get to the admin-GUI.
*** Glassfish Ubuntu package ***

The above instructions are tested on the official release from Glassfish's homepage. We had this report from a user of the glassfish package on ubuntu.

I had to modify the following to make it work with the Ubuntu 9.04 glassfish package.

1. Modify /usr/bin/asadmin
   #GF_DOMAIN_DIR=$HOME/glassfishv2
   GF_DOMAIN_DIR=/var/lib/glassfishv2/domains
2. Set APPSRV_HOME to /usr/share/glassfishv2
The Ubuntu package has the domains and binaries separated. When following the install instructions, when you do anything with the domain you have to point to /var/lib/glassfishv2/[directory] instead of $APPSRV_HOME/[directory].

Weblogic

EJBCA should work fine with Weblogic 9.x or 10.x on Oracle 9 or 10 databases, except as noted below.
Running on weblogic has some limited functionality compared to JBoss:

  • The CMP tcp listener, which runs as a JBoss MBean does not work on Weblogic.
  • Web service interface (including xkms), which uses JaxWS does not work (yet).
  • The timer service does not work on Weblogic 10.3, so EJBCA services will not work.
Note: After installing Weblogic, don't forget to install the "Unlimited Strenth Crypto" jce files in Weblogics jre and jrockit. It's the same way as for a regular installation, see User's Guide.
*** Configure EJBCA ***

 

  1. Set the environment variable APPSRV_HOME pointing to for example /bea/weblogic92 (weblogic.jar is located under APPSRV_HOME/server/lib).
  2. Edit conf/ejbca.properties and change/set some values:
    appserver.type=weblogic
    logging.log4j.config=basic
  3. Edit conf/database.properties and edit/set some values that are specific for Weblogic:
    datasource.jndi-name-prefix=
    weblogic-oracle-columntype=@weblogic.dbms-column-type Blob
  4. Edit conf/web.properties and change/set some values:
    httpserver.pubhttp=7001
    httpserver.privhttps=7002
  5. Edit conf/mail.properties and set:
    mail.jndi-name=mail/EjbcaMail
    (it can be anything of your choice, but this is our suggestion).
  6. Edit conf/jaxws.properties and change/set some values:
    ejbcaws.enabled=false
  7. Edit conf/web.properties and set at least default ports:
    Default http port of Weblogic is 7001.
    Default SSL port of Weblogic is 7002.
  8. Edit conf/jaxws.properties. Disabling ejbcaws must be done until we have fixed JaxWS configuration for weblogic.
    ejbcaws.enabled=false
    See https://jira.primekey.se/browse/ECA-687, tips are welcome.
  9. Edit conf/xkms.properties and change/set some values:
    xkms.enabled=false (Default from EJBCA 3.10.)
    Disabling xkms must be done until we have fixed JaxWS configuration for weblogic.
  10. Edit 'jndi.properties.weblogic' in the directory 'ejbca/conf'and modify the principal and credentials according to you weblogic domain's setting (same as the user name/password to login weblogic console). The default in the EJBCA installation is system/weblogic.
    Every time you issue a 'ant clean' command, you must re-do this step.
If you had issued an 'ant' command before, it is now important to do 'ant clean' before building again. Build ejbca.ear (ejbca/dist/ejbca.ear) with 'ant'.
*** Configure Weblogic ***

 

  1. Create EJBCA domain with weblogic configuration wizard, select Basic weblogic server domain, Express, Development mode, sun's JDK at bea's home directory, and remember the admin username/password.
    • Wls 9.2 will create a default 'mydomain' for you the first time it is started.
    • Access the Weblogic management console at: http://127.0.0.1:7001/console/
    • You can set WLS_USER and WLS_PW environment variables so you don't have to enter username/pwd when starting Weblogic.
  2. Create EjbcaPool and EjbcaDS in Weblogic, the JNDI name should be the one specified in ejbca.properties.
    In Weblogic9, you only create a 'Data Source', no Pools exists any longer.
    Don't forget to apply a Target for your DataSource.
    Example EjbcaDS in Weblogic 9.2:
    URL: jdbc:bea:oracle://127.0.0.1:1521
    Driver: weblogic.jdbcx.oracle.OracleDataSource
    Properties: user=weblogic
                   portNumber=1521
                   SID=XE
                   serverName=127.0.0.1
    
  3. Create tables in the database configured for EjbcaPool and EjbcaDS in Weblogic.
    You can do an 'ant bootstrap' to JBoss if you want JBoss to create the tables for you.
    On oracle XE you can run for example: sqlplus weblogic@XE @create-tables-ejbca3-oracle.sql
    select table_name from user_tables; -- to list tables
    See the file create-tables-ejbca3-oracle.sql for table definitions, or just run /doc/howto/create-tables-ejbca3-oracle.sql for Oracle.
  4. Create a new java mail session for user notification in UserAdminSessionBean. In Weblogic, the JNDI name should be "mail/EjbcaMail" (same as you configured in mail.properties).
    key in the properties:
      mail.store.protocol=pop3
      mail.transport.protocol=smtp
      mail.user=foouser
      mail.pop3.host=pop.foo.com
      mail.smtp.host=smtp.foo.com
      mail.smtp.port=25
      mail.smtp.auth=false
      mail.smtp.starttls.enable=false
      mail.from=foouser@foo.com
      mail.debug=false
      
    Do not forget to activate the mail session in you target server.

If installing with Oracle, perhaps you need to replace jdbc driver at weblogic_home\server\lib, weblogic_home\server\ext\jdbc\oracle\920, 10g all to 10.1.0.2, in my case which is Weblogic 9.2.0. I have used Beas Oracle driver in Weblogic 9.2 with Oracle XE 10, and that works fine. Your mileage may vary, some JDBC drivers were known to be buggy earlier, but it seems to have improved.

*** Deploy and setup ***

 

  1. Deploy the ejbca.ear file in weblogic, it should deploy straight away without errors. Activate the deployment.
  2. Run 'ant install' to do the installation. Everything should work here with no errors. If you get errors these must be resolved before we can move on.
    The command 'ant install' is only run once, when the CA is first installed. It creates lots of things in the database, and can not be run again (it will give an error if you try).
  3. Configure SSL in Weblogic:
    1. (Optional for Weblogic 10.3:) Copy $EJBCA_HOME/p12/truststore.jks to $BEA_HOME/jre/lib/security/cacerts, so that Weblogic can trust the initial CA installed when doing 'ant install'.
      You can create a new 'cacerts' file with 'rm $EJBCA_HOME/p12/truststore.jks' and then 'ant javatruststore'. Type 'ant -p' to get a description how you can run 'ant javatruststore' with arguments to point to a specific keystore etc. You can get the CA certificate with 'bin/ejbca.sh ca getrootcert cert.pem'.
    2. Configure weblogic server for SSL.
      For Weblogic 9.2.0: Servers->Myserver->Configuration->Keystores (or SSL), click "Change", select "Custom Identity and Java Standard Trust"
      - Custom Identity Keystore: path to tomcat.jks generated while "ant install" (ejbca/p12/tomcat.jks),
      - Private Key Alias: localhost (httpsserver.hostname in conf/web.properties).
      The alias is what you configured as httpsserver.hostname in conf/web.properties
      - Passphrase: serverpwd (httpsserver.password in conf/web.properties).
      The password is what you configures as httpsserver.password in conf/web.properties.

      For Weblogic 10.3.0: Servers->examplesServer->Keystores (or SSL), select "Custom Identity and Custom Trust"
      Same as for Weblogic 9.2.0, but you can also configure custom trust:
      - Custom Trust Keystore: path to truststore.jks generated while "ant install" (ejbca/p12/truststore.jks),
      - Passphrase: changeit (java.trustpassword in conf/web.properties).

      Servers->Myserver->Configuration->SSL->Advanced->Server Attributes->Two Way Client Cert Behavior:
      - Client Certs Requested But Not Enforced

      Servers->Myserver->configuration->general, check "SSL Listen Port Enabled", note that the port should be same as httpserver.privhttps in ejbca.properties.
This should make the Admin GUI work, note to install the Unlimited Strength Jurisdiction Policy Files from java.sun.com for both sun's JDK and BEA's JDK first before installation. For Weblogic 10.3 it wa possible to skip the installation of the bundled JDK's and use a pre-installed Sun JDK.
*** TransactionTimeoutException in Weblogic ***

If you are running on a not-so-fast machine, you may experience TransationTimeoutException during 'ant install'. This is due to that it takes a long time for RSA key generation. To configure the transaction timeout to a larger value in weblogic:

  1. logon to Weblogic Console with IE, for example, http://localhost:7001/console.
  2. click "Services" at the left "Domain Structure" navigation frame to expand the service list.
  3. click "JTA" to display the JTA property setting page at right content frame.
  4. update the first property "Timeout Seconds" to a rational value that is enough to execute EJBCA installation (about 100s to finish the whole installation, but I recommend at least 5 minutes, i.e. 300s).

OC4J (EJBCA >=3.6)

EJBCA has been tested on Oc4j 10g (10.1.3.5.0) using Oracle 10g database.

Don't forget to install 'Unlimited Strength Jurisdiction Policy Files' for Java.

A bug in the version of TopLink bundled with Oc4j causes BLOB deserialization to fail under Java 6. See Glassfish bug report on the subject.

EJBCA's automatic authorization tests fails. This might be a lack of working transactions with Toplink. Suggestions are appreciated.

*** Configure EJBCA ***

 

  1. Set environment variable APPSRV_HOME=$OC4J_HOME
  2. Edit conf/ejbca.properties, you should at least set appserver.type, appserver.home and logging.log4j.config.
  3. Edit conf/database.properties, you must configure the database settings for your chosen database, including username and password.
    use 'datasource.jndi-name-prefix=jdbc/'
  4. Edit conf/web.properties, you should set desired values and also http/s ports.
  5. Edit conf/mail.properties set and 'mail.jndi-name=mail/DefaultMail'
  6. Edit conf/jndi.properties.oracle
  7. You may have to remove line 186 in build.xml to make everything compile:
    <jsp-compile uriroot="${adminweb.build}" />
Build EJBCA with 'ant'.
(toplink-ejbca-jar.xml will be populated with your configured database settings)
Do 'ant clean' first if you have tried with different appservers, or database settings.
*** Configure OC4J ***

 

  1. Create tables in your Oracle database using the script supplied in doc/howto/create-tables-ejbca3-oracle.sql.
  2. Configure $OC4J_HOME/j2ee/home/config/application.xml to not create tables: autocreate-tables="false"
  3. Configure a mail session in $OC4J_HOME/j2ee/home/config/application.xml.
     <mail-session location="mail/DefaultMail" smtp-host="localhost">
      <property name="mail.transport.protocol" value="smtp"/>
      <property name="mail.smtp.from" value="localhost"/>
    </mail-session>
    
  4. Configure transaction timeout in OC4J to a bit longer (in order to be able to generate 4096 bit keys for example).
    In $OC4J_HOME/j2ee/home/config/transaction-manager.xml, change:
    transaction-timeout="30"
    to
    transaction-timeout="300"
  5. Configure a connection pool (EjbcaPool) and a datasource in Oracle AS (EjbcaDS, jdbc/EjbcaDS).
  6. There is an orion-application.xml under src/deploy/ear/META-INF that you can edit if you really know what you are doing with OC4J.
    Normally you don't edit this file.
  7. Give the server some more PermGen space, otherwise re-deploying and re-starting will not work very often. Do this by adding '-XX:MaxPermSize=192m' as a new parameter under server->Administration->Server Properties->Start-parameters or use OC4J_JVM_ARGS="-XX:MaxPermSize=192m".
*** Deploy and setup ***

To be able to use the WS-API you must select 'search local classes first' for 'ejbcaws' under 'Configure classloading' (step 3) when deploying the ejbca application. Otherwise you have to set 'xkms.enabled=false' in conf/xkms.properties (default from EJBCA 3.10), and 'ejbcaws.enabled=false' in conf/jaxws.properties, and also edit src/deploy/ear/META-INF/orion-application.xml

  1. Start OC4J (bin/oc4j -start) and log into the admin console of Oracle AS and deploy EJBCA.
    'Automatically create a new deployment plan' = checked in step 1.
    'Application Name' = ejbca in step 2.
    'Configure Class Loading' -> 'Search Local Classes First' = true for 'ejbcaws' and 'xkms' in step 3.
  2. Now you can run 'ant install' to install EJBCA. You should configure OC4J to use a single RMI port for EJB access, and configure this port in conf/jndi.properties.oracle.
  3. Configure SSL in OC4J and make sure the SSL information is passed on to Java, not terminated in Apache.
    • If you have SSL directly in OC4J:
      Copy file $OC4J_HOME/j2ee/home/config/default-web-site.xml to $OC4J_HOME/j2ee/home/config/secure-web-site.xml and edit to reflect these changes:
       <?xml version="1.0"?>
          <web-site xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/web-site-10_0.xsd"  
              port="8889" display-name="OC4J 10g (10.1.3) Secure Web Site" schema-major-version="10" schema-minor-version="0" secure="true">
              <default-web-app application="default" name="defaultWebApp" />
              <access-log path="../log/secure-web-access.log" />
              <ssl-config keystore="path-to-ejbca/p12/tomcat.jks" keystore-password="serverpwd" needs-client-auth="true" />
          </web-site>
      
      Add the following to $OC4J_HOME/j2ee/home/config/server.xml
      <web-site path="./secure-web-site.xml" />
      
      Also figure out a way to bind ejbca to the secure site, or it may disappear from time to time... If you know how this works, please let us know...
    • If you have an Apache front-end:
      • Enable SSL in Apache:
        These options must be enabled in ssl.conf:
        SSLVerifyClient require
        SSLOptions +StdEnvVars +ExportCertData
      • Add EJBCA CA-certificate to wallet with owm (oracle wallet manager)
      • Enable SSL in opmn
        Open opmn.xml in a text editor.
        In the <ias-component id="HTTP_Server"> entry, change the start mode from "ssl-disabled" to "ssl-enabled".
        After modification is made, the entry should look like the following:
        <data id="start-mode" value="ssl-enabled"/>
      • Update mod_oc4j.conf
        Add this line
        Oc4jExtractSSL On
      • opmnctl shutdown; opmnctl startall
After this you should be able to access the admin-GUI in EJBCA.
*** Runtime ports ***

OC4J have a habit of changing the runtime ports used for remote EJB calls every time it starts. This causes problems with the EJBCA command line interface. The port used by the EJBCA cli is configured in conf/jndi.properties.oracle, and you don't want to change this and to a complete 'ant' cycle every time you restart the server. To make OC4J use a fixed runtime port you can go to Cluster Topology->Runtime Ports page of the Application Server Control. Set 'Port Range' to the single value, that you can pick from 'Port in Use'.

Websphere (EJBCA 3.6)

EJBCA 3.6 has been tested with Websphere ND 6.1 and Oracle 10g or PostgreSQL 8.2 database.
(Websphere Express seems broken and Websphere Community Edition is a completely different appserver).

Note! Due to the massive work involved to support Websphere not all versions will be deployable. Currently only EJBCA 3.6 is possible to install on Websphere.

Install the Unlimited strength crypto policy files for the IBM java shipped with Websphere. You need to download these files from IBM. The IBM policy files version 1.4.2 works with IBM JDK 5.

Websphere runs with IBMs java 5 and EJBCA should be compiled with this compiler as well.

Installing Websphere on Ubuntu linux requires you to change /bin/sh to /bin/bash in all shell scripts, because Ubuntu uses /bin/dash as /bin/sh but Websphere requires bash.

sudo perl -p -i -e "s/\/sh$/\/bash/"  /opt/IBM/WebSphere/AppServer/bin/*.sh

(point the IBM directory to where you install Websphere)

*** Configure EJBCA ***

 

  1. Edit conf/ejbca.properties, you should at least set appserver.type, appserver.home and logging.log4j.config.
  2. Edit conf/database.properties, you must configure the database settings for your chosen database.
    use 'datasource.jndi-name=EjbcaDS' (default)
    use 'datasource.jndi-name-prefix=jdbc/'
  3. Edit conf/web.properties, you should set desired values and also http/s ports (i.e. 9080 etc).
  4. Edit conf/mail.properties, set 'mail.jndi-name=EjbcaMail'
  5. Edit conf/jaxws.properties, set 'ejbcaws.enabled=false'
    You can use the WS-API, i.e set the property to true, in WebSphere. But if you do not plan to use it, we recommend that you keep it as false. See below for more WS-API info.
  6. Edit conf/xkms.properties, set 'xkms.enabled=false' (default from EJBCA 3.10)
  7. Edit conf/log.properties, enable the ProtectedLogDevice, 'usedLogDevices=Log4jLogDevice;ProtectedLogDevice'
  8. Edit conf/jndi.properties.websphere and set the currect port from Servers->Application servers->server1 (your server)->Ports->BOOTSTRAP_ADDRESS.
Build EJBCA with 'ant'.
(files in src/deploy/websphere will be populated with your configured database settings)
Do 'ant clean' first if you have tried with different appservers, or database settings.
*** WebService API ***

If is possible to use the WebService API in WebSphere. Most API functions are working, while a few seems to be hit by incompatibility issues. When EJBCA with WS-API is deployed in WebSphere you can use the regular WS CLI (command line interface) to make WS calls from another machine.
The wsdl is accessible using the url: http://localhost:9080/ejbca/ejbcaws/ejbcaws?wsdl

It is also possible to deploy EJBCA WebService API in Websphere as a separate war file.
AFTER you have deployed and installed EJBCA below you can perform these steps:

  1. Generate the stand alone ejbcaws.war file for Websphere with 'ant ejbcaws.war.standalone'.
  2. Deploy the file dist/ejbcaws.war in Websphere.
  3. Get the generated WSDL with url: http://127.0.0.1:9080/ejbcaws/ejbcaws?wsdl
  4. Configure the ejbcaws CLI in dist/ejbcawscli/ejbcawsracli.properties.
*** Configure Websphere ***

Configure Websphere in the admin console.

  1. Create tables in your database using the script supplied in doc/howto/create-tables-ejbca3-oracle.sql or doc/howto/create-tables-ejbca3-postgres.sql.
  2. Navigate to 'Resources->Mail->Mail sessions' and create a new MailSession called 'MailSession' with jndiName same as mail.jndi-name configured in conf/mail.properties (EjbcaMail).
  3. Create a new DataSource:
    Creating a datasource for Oracle:
    • Install the oracle jdbc jar (ex ojdbc4.jar) in $WAS_HOME/lib.
    • Navigate to Resources->JDBC->JDBC Providers
    • Select for example Cell scope, and click New
    • Select 'Oracle' from 'Database type' dropdown
    • Select 'Connection pool data source' from 'Implementation type' dropdown
    • Insert the path to the jar file, i.e. $WAS_HOME/lib
    • Finish and save
    • Navigate to Resources->JDBC->Data sources
    • Select for example Cell scope, and click new
    • Provide a data source and Jndi name, jndi name must match the jndi-name-prefix and jndi-name configured in database.properties, e.g. jdbc/EjbcaDS
    • Click next
    • Select your created JDBC Provider, and click Next
    • Enter the database URL, e.g. jdbc:oracle:thin:@127.0.0.1:1521:ejbca
    • Select 'Oracle10g data store helper', and click Next. The checkbox 'Use this data source in container managed persistence (CMP)' must be checked.
    • Finish
    • Navigate to Resources->JDBC->Data sources
    • Select the created data source
    • Click on the 'JAAS - J2C authentication data' link
    • Add new record:
      Alias: ejbca
      User ID: ejbca
      Password: ejbca
    • Save all changes
    • Go back to the datasource and select the create authentication provider as 'Component-managed authentication alias'
    • Click OK and save all changes
    • You can now go in and 'Test Connection' for your new DataSource. Make sure it is successful
    Creating a datasource for PostgreSQL:
    • DataSourceProvider: For postgres I used 'User-defined' type and implementation class name 'org.postgresql.jdbc3.Jdbc3ConnectionPool', or 'org.postgresql.xa.PGXADataSource'. I used the jdbc driver postgresql-8.2-507.jdbc3.jar.
    • DataSource: You have to add Custom Properties to the datasource with databaseName, serverName and port (port is optional).
*** Deploy and setup ***

Log into the admin console of Websphere to deploy EJBCA.

  1. Install new application.
  2. Select ejbca.ear and 'Show me all installation options and parameters' and click next.
  3. Click next. Click next all the time unless anything else is noted here.
  4. When you get the option to select database type at Step 3 (Deploy EJB option - Database type) select 'ORACLE_V10G' for Oracle, or empty for PostgreSQL.
  5. At the next step, Step 4, select Current Backend Id, ORACLE_V10_1 for Oracle or CLOUDSCAPE_V51_1 for PostgreSQL (if using Oracle you may not get this choice).
  6. Click next until you reach the end, or jump directly to the last step by clicking in the left meny.
  7. Click finish
  8. In order to use the cli in EJBCA you must copy the generated ejbca-ejb.jar to local lib, so we have it in the classpath for command line operations. example: cp /opt/IBM/WebSphere/AppServer/profiles/AppSrv04/installedApps/computerNode01Cell/EJBCA.ear/ejbca-ejb.jar $EJBCA_HOME/lib/.
  9. Now you can run 'ant install' to install EJBCA.

Efter deployment and installation you want to configure SSL in Websphere so you can access the Admin-GUI in EJBCA. The admin-GUI in EJBCA requires client certificate authentication.
Configure the SSL port to require client certificate in order to access the admin-GUI:

  1. Navigate to Servers->Application servers->server1->Web Container Settings->Web container transport chains
  2. Change the WCInboundDefaultSecure to require client certificate. The trick is to create a new node SSL configuration that manages this connection. You don't want to require SSL in the NodeDefaultSSLSettings, since that will apply to your Websphere admin as well. You set 'require client cert' in the Quality of protection settings.
  3. Add the CA certificate from EJBCA to the default trust store and use that. In Websphere ND you add certificates to the truststore under Security->SSL Certificateas and key mgmt->Key stores and certificates->CellDefaultTrustStore->Signer certificates.
    You can download the certificate for AdminCA1 for example with the CLI command:
    bin/ejbca.sh ca getrootcert AdminCA1 adminca1.der -der
    Then you add the certificate in CellDefaultTrustStore as 'Binary DER data'.
  4. You have to restart the server after configuring this (complete restart with server, node and mgr).
  5. (You can also add a new server SSL keystore by creating a PKCS12 file in EJBCA and adding that in 'Key stores and certificates' and using it in the SSLSettings for WCInboundDefaultSecure).
After this you should be able to access the admin-GUI in EJBCA after installing $EJBCA_HOME/p12/superadmin.p12 in your browser.

Public web will be at: http://127.0.0.1:9080/ejbca/index.jsp
Admin web will be at: https://127.0.0.1:9443/ejbca/adminweb/index.jsp

The default password for SSL keystore (key.p12) in Websphere is WebAS.

Files deployed

Here we describe shortly which files are copied during ant bootstrap and ant deploy. These targets only modified files automatically on the JBoss platforms, but it will give an indication as well for other platforms what configuration steps are needed.

ant bootstrap

  • deploy/ejbca-ds.xml
  • deploy/ejbca-mail-service.xml
  • deploy/ejbca.ear

ant deploy

  • Files from ant bootstrap
  • conf/keystore/keystore.jk
  • conf/keystore/truststore.jks
  • deploy/jboss-web.deployer/server.xml
分享到:
评论

相关推荐

    开源ejbca 8.0 版本

    EJBCA是一款开源的企业级证书颁发机构(CA)系统,专为管理数字证书和PKI(公钥基础设施)设计。在"ejbca-ce-EJBCA_8_0_20230531"这个压缩包中,包含的是EJBCA 8.0版本的源代码及其相关组件。下面我们将详细探讨...

    基于EJBCA 搭建自己的CA认证中心之EJBCA安装配置指南

    ### 基于EJBCA 搭建自己的CA认证中心之EJBCA安装配置指南 #### 1. 概述 公钥基础设施(Public Key Infrastructure, PKI)是一种用于管理和验证数字证书的系统,它能有效地解决Web应用中的机密性、完整性、真实性和...

    EJBCA安装与配置

    ### EJBCA安装与配置详解 #### 一、引言 EJBCA是开源的Java企业级证书颁发机构(Certificate Authority,简称CA),它提供了全面的企业级PKI(Public Key Infrastructure)解决方案,适用于各种规模的企业。本文将...

    ejbca的安装(ejbca_3_5_4 + jboss-4.2.2.GA)

    EJBCA是一款开源的PKI(Public Key Infrastructure,公共密钥基础设施)系统,用于创建、管理和分发数字证书。EJB(Enterprise JavaBeans)是Java EE(Java Platform, Enterprise Edition)规范的一部分,用于构建可...

    EJBCA的结构分析

    ### EJBCA的结构分析 #### 一、引言 EJBCA是一个开源的证书颁发机构(CA),主要用于创建和管理数字证书。本文旨在系统地介绍EJBCA的架构,并对其内部结构进行深入分析。此外,还将涉及相关的密码学知识,帮助读者更...

    ejbca 文档(研究生论生)

    本文档从 EJBCA 的概述、EJBCA 的主要功能、EJBCA 的研究发展历史、EJBCA 与其它一些类似软件比较、EJBCA 在校园网中的应用等几个方面对 EJBCA 进行了详细的介绍和分析,为读者提供了一个系统的 EJBCA 知识体系。...

    EJBCA安装教程

    EJBCA是一款开源的企业级证书颁发机构(CA),用于管理公钥基础设施(PKI)。本教程将指导你完成EJBCA在Windows 7 64位系统上的安装过程。 首先,确保准备好所有必要的软件: 1. JDK 1.6.0_9:Java Development ...

    傻瓜式ejbca安装过程

    ### 傻瓜式EJBCA安装过程详解 #### 一、背景介绍 本文将详细介绍如何在Windows XP环境下安装EJBCA 3.6.3系统,并配置其与MySQL及OpenLDAP协同工作。EJBCA是一款开源的企业级证书管理平台,广泛应用于数字证书的签发...

    ejbca_4_0_10.zip

    EJBCA是一个开源的企业级公共密钥基础设施(PKI)解决方案,用于管理和颁发数字证书。这个名为"ejbca_4_0_10.zip"的压缩包包含的是EJBCA 4.0.10版本的安装文件,它是针对JBoss应用服务器5.1.0 GA版本优化的。在本文...

    ejbca-ejb.jar

    是开源项目EJBCA所需的一个包,如果想要把EJBCA项目导入eclipse中进行查看,会发现缺少好多的类,但是哪里都找不到,那些类都是在EJBCA安装过程中编译到这个jar包里的,如果不想安装EJBCA,就从这里下这个包吧!

    linux下jboss服务器ejbca安装成功教程

    ### Linux环境下JBoss服务器EJBCA安装指南 #### 概述 本文档将详细介绍如何在Linux环境下安装配置JBoss服务器及其上的EJBCA证书管理平台。此过程包括必要的软件下载、环境变量配置以及安装步骤等内容。通过遵循本...

    ejbca实例

    对EJBCA的简要的概述

    EJBCA创建证书图解

    **EJBCA创建证书图解** EJBCA是一个开源的企业级PKI(Public Key Infrastructure)系统,用于管理和分发数字证书。它基于Java开发,遵循X.509标准,提供了强大的证书颁发机构(CA)功能。在这个图解教程中,我们将...

    EJBCA操作文档.docx

    EJBCA是一个基于J2EE技术的全功能证书颁发机构(CA)系统,它具有高度灵活、高性能和可扩展的特性。系统分为开源社区版和企业版,两者都支持多CA和多级CA结构,但企业版提供官方支持和更高级的功能。EJBCA的部署方式...

    EJBCA+mysql+jboss安装布署

    ### EJBCA + MySQL + JBoss 安装部署详细指南 #### 一、概述 本文档旨在提供一套详尽的指南,帮助读者顺利安装和部署 EJBCA(Enterprise JavaBeans Certification Authority)证书管理系统、MySQL 数据库以及 ...

    ejbca_安装过程

    ### EJBCA安装过程详解 #### 一、EJBCA概述 EJBCA是一套基于J2EE的企业级证书颁发系统,为各种应用提供了强大的数字证书管理功能。作为一个开源项目,它遵循LGPL许可协议,适用于J2EE 1.3以及EJB 2.0规范。其主要...

Global site tag (gtag.js) - Google Analytics