How to create/update/refresh the expired client certificate which is used for accessing admin EJBCA panel (v.8.2.0.1)

[zentavr]

Hello,

I had a client certificate which I had used to access the admin panel of EJBCA (v8.2.0.1). It was pinned there by serial number.

Right now I do not have an access to the panel, but have access to the VM where the tool is installed (both the cli and PostgreSQL).

I had found in the manuals, that it is possible to reset the certificate state using the CLI, something like this:

/opt/ejbca/bin/ejbca.sh ra setendentitystatus --username zentavr -S 10
/opt/ejbca/bin/ejbca.sh ra setclearpwrd 'zentavr' 'entity-pw'
/opt/ejbca/bin/ejbca.sh batch --keyalg RSA --keyspec 4096

The first command works well, I can see in the PostgreSQL database that the value changes. But the second ejbca.sh ra setclearpwrd and the third batch does nothing.

Could it be that my $EJBCA_HOME/dist/ejbca-ejb-cli/ejbca-ejb-cli.jar not contain some piece of modules? Maybe I can hack that by stopping the software, adjust the DB and start the software again?

[zentavr]

The table structure looks like this:

[primetomas]

Check out the cli command "bin/ejbca.sh roles" it will allow you to modify your roles and role members.

[zentavr]

Yeah, but the problem is that ra setclearpwrd does nothing.

[primetomas]

I think setclearpwd does something. More likely that the end entity does not have a correct token type, i.e. that it is set to "usergenerated". You can check the details of the existing end entity with "bin/ejbca.sh ra finduser zentavr". It will display "Token type", which should be 2 in order to do batch.
You can also btw specify the username to the batch command "ejbca.sh batch --keyalg RSA --keyspec 4096 --username zentavr".
But if token type is 1, it means you have to generate a CSR and enroll using the RA Web,
You can add a new administrator user if you like with "bin/ejbca.sh ra addendentity --help", and add this user certificate to roles using the CLI...

[zentavr]

@primetomas the /ejbca/ra/ URL not works in our case. When pressing "Log In" we have No OAuth providers configured. Please log in using a valid certificate.. We always used client certificates for the admin users to connect to /ejbca/adminweb/ URL.

Right now we resolved that problem using other's administrator account (that person is not available immediately unfortunately), so that's why I had been asked to create and provide the manual for my company what to do if such case happens in the future.

I'm going to create a "test" user and simulate the key expiration so I could repeat all the steps which need to be done in future.