What features of EJBCA can be controlled via environment variables passed to the docker container?

[ralienpp]

My objective is to start EJBCA with CMP over TCP enabled. However, I would like to know what other features can be controlled this way.

Context: I am considering creating a guide about the usage of CMP client libraries. For this reason I need an easy way to spin up a throw-away CA, for experiments. The documentation brought me to this command docker run -it --rm -p 80:8080 -p 443:8443 -h mycahostname -e TLS_SETUP_ENABLED="simple" keyfactor/ejbca-ce.

It is very close to what I need, but ideally - I'd like to automate this as much as possible, so there's no clicking or config editing involved. Is there documentation about these environment variables?

[primetomas]

CMP over TCP is a build time option, so can not be enabled in the container without replacing the ejbca.ear file.
In addition, the TCP transport is deprecated in the CMP standard, and I don't know of anyone using that any longer. We are considering removing it completely from EJBCA in the future. Do you know of anyone actually using CMP over TCP?

[ralienpp]

Thanks for the answer, I was not aware that it is a build-time option, so my best course of action is to rely on the "over HTTP" flavour, because that would be the path of minimum resistance for a beginner.

Still, I would like to know what environment variables are available, just to understand the spectrum of possibilities better.

As for your other remarks:

1. Can you point me to the sources that say CMP over TCP is deprecated? What's the rationale? I'm aware of other transport options, like CoAP or HTTP, but I don't recall any RFC that advocates pulling TCP from under CMP's feet.
2. I'm not a representative sample, but: (a) in a company where I worked, we built a PKI-based system of virtual currency, and we used CMP/TCP; (b) the PKI managed by the government of a small country in Eastern Europe used it at the time I was there. In both use cases CMP/HTTP was also supported, therefore there was nothing that really tied us to plain TCP transport. Also note that this happened quite a few years ago, so the current status is unknown to me.

[primetomas]

1. https://datatracker.ietf.org/doc/html/rfc6712 updates CMPTrans as referenced in RFC4210, and simply leaves out TCP (I was part of the discussion for this draft)
   CMP Updates (CMP v3) talks about HTTP and CoAP. https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cmp-updates-23#section-3.1

For environment variables you can use docker inspect to view all available. See "Other Environment Variables" in https://hub.docker.com/r/keyfactor/ejbca-ce