EJBCA issuing multiple identical certificates when status is Generated

[medinasj]

Hello,

Recently, I was testing certificate generation using the CMP protocols in the community version of EJBCA 8.3.2. When I submit multiple requests for the same certificate to the CMP endpoint, I receive a new certificate each time. Am I missing a configuration setting or something else?

[primetomas]

That is as it should. Each CMP call is a new enrollment request and will issue a new certificate. There is no such thing as a "request for same certificate". Your request (Certificate Signing Request in CRMF, RFC4211, format) may look the same, but it is a request for a new certificate with those details every time.
See RFC4210 for details.

[medinasj]

The same thing happens with one of the REST endpoints. Does this imply that it is the responsibility of the client application to protect the EJBCA CA server from potential flooding by implementing a mechanism to limit the number of certificate issuance requests for valid certificates?

[primetomas]

You are using these end points in "RA mode". This means that your client is a trusted entity, strongly authenticated and authorized. So yes, the RA client is supposed to be able to make the decision to issue. An RA is not the general public.
In contrast there is "Client Mode" where pre-registration and a single enrollment is the way.

See here: https://docs.keyfactor.com/ejbca/latest/cmp#id-(9.2)CMP-ClientModeforCMPClient_mode_for_CMP
vs here: https://docs.keyfactor.com/ejbca/latest/cmp#id-(9.2)CMP-RAModeforCMPRA_mode_for_CMP

For generic information on what an RA is:
https://www.keyfactor.com/blog/what-is-a-registration-authority/
https://en.wikipedia.org/wiki/Public_key_infrastructure