Integrate EJBCA as a Certificate Authority in Workspace ONE UEM

[FBL-dev]

Hello,

I am trying to integrate EJBCA into Workspace ONE UEM.
I have added the user certificate in the Windows Certificate Store of my Workspace ONE UEM/Airwatch Cloud.
On Workspace ONE, I indicate :
Authority Type: EJBCA
Server URL: https://my-pki-server/ejbca/ejbcaws/ejbcaws
Certificate: My_user.p12

However, when I test the connection, I get “Test is unsuccessful”.
And here's the error I get in the logs:

AirWatch.CloudConnector.CertificateService.CertificateService_EJBCA testConnectionRequest.AuthenticationCertificate/AuthorityURL cannot be null or empty.
Method: AirWatch.CloudConnector.CertificateService.CertificateService_EJBCA;

Do you have any idea where my problem comes from?

Thanks

[lucas-carneiro]

Hi @FBL-dev, did you found the cause of it? Having the same issue

[FBL-dev]

Hi @lucas-carneiro,
No, unfortunately I'm still looking for a solution.
If you find a solution, please let me know.

[MB31]

Check if the ACC trusts the certificate from the workspace one uem cloud (GoDaddy).
I think the certificate used talking to EJBCA (RA), should be in de LocalMachine store, not in CurrentUser.

[smgehrig]

Do you have the AIA field configured in your certificate? http://www.pkiglobe.org/auth_info_access.html
This fixed it for us

[FBL-dev]

Hello,
Yes, I have the AIA field in the certificate

[lunor1]

@FBL-dev Have you found a solution? We have the same issue here.

[FBL-dev]

I'm still stuck on this issue as well. No solution on my end yet.

[primetomas]

I guess this is the documentation you are following?
https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2212/Certificate_Authority_Integrations/GUID-EJBCA.html

[lunor1]

Correct. And I have alos gone thru the blog: https://veucaddict.com/blog/integrate-ejbca-certificate-authority-in-workspace-one-uem/
After some troubleshooting (going direct to the VA-node instead of going thru a LB and created a new certificate for the RA User and imported it to UEM and Airwatch Cloud Connector Cert store) we are now getting another error mesage: Not authorized to Web Services.

We have applied most of the permissions to the user we use. Any idea?

[FBL-dev]

I don't fully understand your message:
“going direct to the VA-node instead of going thru a LB and created a new certificate for the RA User”.
Can you explain in more detail how you did this?
And how did you get the certificate in .pfx format (mine is currently in .p12 format)?
Thank you

[lunor1]

We have a two node cluster. And first, we terminated the SSL in the LB. And that broke the Certificate auth from UEM to EJBCA.
So now we are going directly to the EJBCA.

I get the Certificate in pfx-format from our PKI team. Have you imported the certificate to the ACC local certificate store (Local Machine\Personal)?

Have you enabled Debug logs in ACC?

[primetomas]

If you get "Not authorized to Web Services" it sounds as if calls to EJBCA has been made. There should then be log items in server.log indicating if there are authorization issues.

[lunor1]

Fantastic!

[lunor1]

Next issue we have is that we cant send CSR requests from UEM to EJBCA that includes SAN attributes (Email, UPN and DNS-Name). In UEM we only get error messgae "Fault occurred while processing".

We have configured the EndEntityProfile to include Mail, DNS Name and MS UPN. We have also configured

If the Certificate Template to be mapped with the Certificate Profile uses "Supply in the request" option, following options need to be enabled in the Certificate Profile:
- Allow Subject DN Override by CSR
- Allow Extension Override for 2.5.29.17 (Subject Alt Name)

Any ideas?

[primetomas]

Check the server log it should be clear there what happens, i.e. if the correct profiles are being used. Sounds like a profile validation error, which should be clearly visible in the log.

[lunor1]

We found the issue. We have space in our CA name in EJBCA. When we requested certificates from Workspace ONE UEM that only have Subject and not SAN attributes, UEM were sending the correct CA name in the request.

But as soon as we added SAN Attributes to the certificate request Workspace ONE UEM removed the space from the CA name and EJBCA gave a "CA not found" error, beacuse Worksapce ONE UEM sending wrong name.

As a workaround we removed the spaces from the CA name and then it worked fine.

[primetomas]

Thanks for the information. I'll update the docs with this information.