Browsers closing the connection with client auth certificates issued by EJBCA

[bugz8unny69]

Hi community,

To get to the point. I have deployed a Docker container of EJBCA and followed this guide here to issue a certificate to myself. I've also added myself to the Super Admin Role. However, for whatever reason, the server is not completing the TLS connection. Nothing relevant in the logs to help, to direct me to the problem, to try to remedy it. The browser simply errors out with PR_END_OF_FILE_ERROR or connect was reset with Chrome. There's an obscure thread on SourceForge about the Wifdly keystore might be broken but the commands to fix it don't exist in the container. Any assistance on this matter would be greatly appreciated.

Regards,
Horace

[primetomas]

An important note, is that you can not deploy with TLS_SETUP="simple" if you want to use certificate authentication. We figured out there was a flaw in one of the guides recently, I don't know if the fix was published yet.
So you first installation need to follow the "Quick start - classic workflow" at https://hub.docker.com/r/keyfactor/ejbca-ce

Cheers,
Tomas

[bugz8unny69]

Thank you for that information, will add it to my ticket. The question is, is it as simple as redeploying the docker container or do I have to start from scratch? And can I use both Oauth and Client certificates together?

Regards

[primetomas]

I just saw a ticket about the sevrer TLS truststore being empty when deploying with TLS_SETUP="simple". You can fix this manually of course, but if it's a test environment it's much easier to re-start. Then you'll have a good process to repeat as well.
Yea you can use both OAuth and Client cert at the same time. Note that OAuth is an Enterprise feature at the moment though.
https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/authentication-methods/oauth-providers