How can EJBCA be configured so that it responds to CMPv2 IR request with a PKIStatus of 'waiting' in the IP response?

[jia345]

I am utilizing the EJBCA Community Edition to set up a PKI infrastructure for testing my CMPv2 client. I aim to simulate a scenario where the server responds to an IR (Initialization Request) with an IP (Initialization Response) message containing a PKISTATUS of 'waiting'. Following this, the client initiates a polling process based on the checkAfter value included in the IP message to monitor the status of the certificate. The EJBCA server, after holding off for a certain period, eventually delivers the certificate to the client, thereby enabling the client to complete the entire initial enrollment procedure. Could anyone guide me on how to achieve this?

[primetomas]

I thought it was possible, but I don't see this in the code actually, so it seems not to be supported. It is supported for SCEP. The truth is that "waiting" has not been desired so far. Every usage of CMP has either implemented approvals in front-end, such as card management systems or another RA, or been used in fully automated use cases. Manual approval processes are rare these days and most are moving towards automation, which is why there is a plethora of validation options to control policy before issuance.

[jia345]

@primetomas Many thanks. I'll have to look for alternative solutions then.

[jia345]

Given that this functionality is not currently supported, I will explore alternative solutions.