How to prevent user to self-generate new certificate when he has already one active?

[lunitaris]

Hello!

I would like to know how to configure EJBCA, so:

• Users can self-enroll to generate certificates (ok, I know how to do that).
• Users cannot generate new certificate when he has already one active.

I am using in the DN:

• First Name
• Last Name
• email
• O : hardcoded
• C: hardcoded

1. So what configuration should I do to do this?

2. Also, If I generate a cert for a user, and I am using 'enforce Unique DN'.
   If the user loose its certificate, the admin will revoke it.
   Now, How can a user generate a new certificate using the same informations?

[primetomas]

1. The "one-time-password" feature of client enrollment is typically what prevents more than one enrollment for end entities. In the default configuration once an added end entity have had a certificate issued, the end entity status is changed from NEW->GENERATED and it's not possible to enroll with that end entity again, until someone/something changes status to NEW again.

2. This is difficult to answer without detailed information about your use case and work-flow. Setting the status of the end entity to NEW enables generating a new certificate for the same end entity, with the same DN as already registered for the end entity.
   There are thousand different ways how this is done for different use cases and work-flows.