EJBCA SCEP Server and Cermonger Client

[schefa11]

Hi all,

I created a setup where I have a certmonger SCEP Client and a EJBCA-ce SCEP Server (CA Mode). Issuing the certificate via "one-time-secret" works well.
After certificate expiration the client tries to request a new one. But the server shows this error:

Got request with status GENERATED (40), NEW, FAILED or INPROCESS required: foo; nested exception is: javax.ejb.EJBException:null

The troubleshooting section of the docu gives a hint to that message

To issue a new certificate to the user, his/her status must be reset to NEW, FAILED, or INPROCESS.

Via bin/ejbca.sh ra setendentitystatus <myusername> 10 I can set the status manually and the client can fetch a new certificate.

I don't want to do that each time when a certificate expires. Is that a bug or the expected behavior?
Will the enterprise feature "Allow Client Certificate Renewal" solve my issue?

I would appreciate any recommendations.

Thanks in advance

schefa

[primetomas]

It could solve it, depending on if the SCEP client actually is performing a renewal request, or is simply trying to renew again.
If you don't mind the "one-time enrollment code" not being one-time you can enable multiple enrollments (up to five) in the end entity profile, or disable "finish user" altogether in the Edit CA settings. Try that to start with.

[schefa11]

Disabling "finish user" works for me. Thank you very much.