Unable to enroll identity using REST API

[adityajoshi12]

I am running my ejbca instance in Kubernetes and exposed directly using the LoadBalancer. I am unable to enroll identity using the REST API. I tried the same thing using the local docker setup and it works there. While checking the ejbca logs I found this error

2024-07-27 12:47:13,983+0000 DEBUG [io.undertow.request] (default I/O-13) Closing SSLConduit after exception on handshake: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
	at java.base/sun.security.validator.PKIXValidator.<init>(Unknown Source)
	at java.base/sun.security.validator.Validator.getInstance(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.getValidator(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(Unknown Source)
	at [email protected]//org.wildfly.extension.elytron.SSLDefinitions$DelegatingTrustManager.checkClientTrusted(SSLDefinitions.java:1198)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkClientCerts(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source)
	at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(Unknown Source)

Below is the CURL command that I am using to enrol.

curl -X POST  --cert-type P12 --cert aditya.p12:aditya -H 'Content-Type: application/json'  -k  --data '{
  "certificate_request": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBgTCCASYCAQAwWzEQMA4........\n-----END CERTIFICATE REQUEST-----",
  "certificate_profile_name": "root-ca-profile",
  "end_entity_profile_name": "sign-certs",
  "certificate_authority_name": "root-ca",
  "username": "server",
  "password": "foo123"
}' https://34.89.80.49:8443/ejbca/ejbca-rest-api/v1/certificate/pkcs10enroll

[primetomas]

Did you configure your LB to pass through TLS client certificates? As per other discussions in here, or the doc on SSL_CLIENT_CERT on the dockerhub page?

[adityajoshi12]

My ejbca instance is exposed as Kubernetes LoadBalancer Service, I can access the GUI at https://34.89.80.49:8443, but the REST API is not working.

[primetomas]

That's strange. Admin UI and REST uses the same TLS endpoint, i.e WildFly stack. The error happens in the app server TLS layer and not in EJBCA itself.
I.e. the same trust anchor is used for the UI and REST API, per for example:
https://stackoverflow.com/questions/6784463/error-trustanchors-parameter-must-be-non-empty

Since it complains about trust anchor and not the client cert itself. Is it the same P12 file that you use for UI access and REST API access?