[CONTAINERS] Separate CA from VA

[aleloco09]

Hi,
It's me again. I am proceeding with my thesis, now what I want to achieve is to separate the VA from the CA using a SCP publisher as descripted here. It looks easy but it is not that simple and the documentation is not so clear to me.
I remind you that all the environment is containerized.
I have successfully created the SCP Publisher that establishes a SSH connection with the SCP Host-container (just a simple machine based on centos:7), what is not clear is how to set up of the external VA.

1. According to the OCSP Responder Mangement documentation page, I should have the following

   Prerequisites for CA UI access:

   • Available TLS keystores as p12/tomcat.jks and p12/truststore.jks (copies from the EJBCA CA), to be deployed with deploy-keystore and web-configure (may require configuration of keystore password in conf/web.properties).
   • An imported Management CA certificate (the certificate of the CA that issues administrator certificates).
   • Configured Administrators with access rules.

   The last two are pretty easy to configure, what I don't understand is how to properly copy the keystores in the VA container. If I have understood well, the keystores are in /opt/keyfactor/wildfly-26.1.2.Final/standalone/configuration (CA side) and I should somehow take those 2 (truststore.jks and keystore.jks) and save in /mnt/external/secrets/tls/ks (VA side), right? But what about the persistency? I see that every time I run the container the old keystores are eliminated new ones are generated... what do you suggest me to do?

2. Looking at this architecture it is not so clear how the connection between SCP host and VA is established. How does the VA take the Certs / CRLs from the SCP host? What I thought was that the SCP Host and the VA should reside in the same container, or volume mount the download directory in the SCP host and make it visible and accessible to the VA

3. How do I actually publish the CRLs from the CA to the SCP server? I know that I should set up a (some?) worker(s), such as CRL Updater, but it is not clear.

Thanks in advance

P.S.: I found your YouTube tutorial videos extremely helpful and informative. They provided a clear understanding of the CA functions and the diverse options available in EJBCA CE. I would suggest also creating content that addresses VA-related aspects, such as OCSP Responders, publishers, and services. Such tutorials would be immensely beneficial for users like me who are exploring these areas.

[primetomas]

1. The dockerhub documentation was recently updated with a link to all env variables, where you can find keystore and strustore password settings. Also the documentation now lists relevant directories so you can see where keystore and truststore is read from so you can volume mount or manipulate these. https://hub.docker.com/r/keyfactor/ejbca-ce
2. The certificate/CRL reader will read from file system, see settings for the Service Certificate and CRL reader. So that directory need to be mounted in.
3. You configure the CRL Publisher in the Edit CA settings.

[aleloco09]

1. Yes I've read that documentation, I took the truststore.jks and keystore located in /opt/keyfactor/wildfly-26.1.2.Final/standalone/configuration (CA side) and put respectively in /mnt/external/secrets/tls/ts and /mnt/external/secrets/tls/ks (both in ca and va side), and then I saw that another keystore was generated in /mnt/persistent/secrets/tls/ejbca-node2/server.jks so i have copied that as well.

How is it possible to test if the TLS connection is successful or not?

[aleloco09]

for the other 2 points i dont get. The connection of the publisher with the scp host is established successfully, the Publisher looks active and it is associated to the CA but the download folders cert and crl are empty...

am i missing something?

[primetomas]

How about the "CRL Publisher" in the CA setting?

Publishing only happens when you issue a certificate or CRL. It should be very visible in the log what happens when a certificate or a CRL is issued.

[aleloco09]

Among the several log messages that occur when I generate a new CRL this is the most relevant.

ejbca-ca           | 2023-11-22 08:29:29,158+0000 INFO  [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-5) 2023-11-22 08:29:29+00:00;PUBLISHER_STORE_CRL;SUCCESS;PUBLISHER;EJBCA;CN=SuperAdmin;;;;msg=Published object CRL successfully to publisher ManagementCA_Pub, status 10.

Apparently it publishes but when i go to the download folder in my scp host /var/ejbca/crl, nothing is there.
The ssh user has the rigth permissions to write inside the folders.
Is there a way to see what happens during the ssh connection between the publisher and the scp host?

[primetomas]

There is not a ton of logging in the SCP publisher, but if you enable DEBUG logging you should see some more details on what happend.

[aleloco09]

For the moment to familiarize with the OCSP mechanism, I'm trying the CRL Download Service, which is easier and i have successfully set.
Now from my VA I have the CRLs of the external CA.

What is not so clear from the documentation is how do i set the OCSP responder / signer, I dont get that procedure.
Can you provide me the steps to do CA side and VA side?

[aleloco09]

Solved.
I need to create an OCSP Responder VA Side, make a CSR for my CA and generate a Certificate for the responder (CA side).
Now it works, simple and easy.
I just need to see how to make the SCP thing work