Enrollment with enrollment code

[jorgelopez200]

Hi.
In "Enrollment with enrollment code" option in RA, the user uses a pre-defined password to request the certificate, but this enrollment password is also used to protect the private key in the generated P12 file. Is there a way to allow the user to specify their own password to protect the private key ?

[primetomas]

If you are logged in as an RA administrator, the "Make new request" method for enrollment allows your RA user to immediately enter information and download the certificate.

[jorgelopez200]

Hi Tomas, thanks for your answer. I was researching about it, and I found the necessary configuration to make the RA publicly available, so an anonymous user can access the RA form and request the certificate using the option "Make new request". It works, however any one could access the RA form, and make any number of requests wanted. I think that would imply a risk with bad intentions people.

I was trying to implement a kind of "Pre-registration" flow, where I generate the "End Entity" with username and "Enrollment Code". An email notification is sent to the user's email with the username and password information. Then I make the RA option "Enroll with username" publicly available and only the user with the username and password is allowed to "Finish" the process, by asking the user for a new password that is going to be used for the private key protection.

In this scenario, the enrollment code would be only used to access the RA form and letting the user to specify a custom password once the user has been logged in RA.

I just wanted to be sure that this scenario is not possible to be implemented in EJBCA. Other than that, I have found EJBCA very useful and mature solution for PKI management.

Thanks in advance.

[primetomas]

The RA web is used like this for "classic workflow" when you start the container. See here and try it out:
https://hub.docker.com/r/keyfactor/ejbca-ce