an issue with KUR response

[Lucy0418s]

Hello, support team. I am trying to test openssl cmp commond with EJBCA server( community version). However, I encountered an issue with KUR and would like to seek your help.

First, I sent the IR command and successfully received the certificate chain and end-entity certificate.

However, when I then sent the KUR command, received some errors. like below:

according to the error message, then I add "-extracerts" in cmd parameters, but received another error as below, I don't know if I add correct extracerts....

maybe I miss some cmp server configuration?

[primetomas]

There are examples using KUR for HMAC authentication in the documentation. Did you try to follow them?
https://docs.keyfactor.com/ejbca/latest/cmp-operations-guide

[primetomas]

No that is not what I meant.

1. Copy-paste KUR commands from the documentation to get the correct parameters. The ones you used are not correct.
2. If you develop an RA it is unnecessary work to use KUR. Your RA only need to implement ir or cr, that's it. Less work for you, same outcome.

[Lucy0418s]

thanks, but I copy-paste and tried the commands that described in documentation in the "

"
but also receive error:

[primetomas]

Right, I double checked in the code. In RA mode the end entity that signs the message must be the RA. It all looks a bit complicated...but might work. I don't have a good sample command though, it might be worth making one. That would only be relevant for certificate authenticated RAs though.
I'm not sure I understand your use case though. If you want to issue the certificate from an RA, but have the end client make a KUR, you can use two different CMP aliases, one in RA mode for the initial enrollment and one in Client mode for the KUR. The URLs are used by other end entities anyhow. If everything is done from the RA, just KUR and make another CR.

[Lucy0418s]

one in RA mode for the initial enrollment and one in Client mode for the KUR. ---this method take effect. I tried and succeed.

Thanks for your support.

but actually I still want KUR when set RA mode. if you can provide a good example command, it would be very grateful.

[primetomas]

Great that it works. I will have to look at examples after summer holidays. But will try to keep it in mind.

Cheers,
Tomas