HMAC Authentication

[pragya1998hal]

I am using CMP Configuration. In CA mode I want to Authenticate through HMAC method. Can you please suggest how to proceed with this. Or can share any relevant document

[primetomas]

There is a lot of documentation, with examples:
https://docs.keyfactor.com/ejbca/latest/cmp
https://docs.keyfactor.com/ejbca/latest/cmp-operations-guide
https://docs.keyfactor.com/ejbca/latest/cmp-interoperability

[pragya1998hal]

Thank you sir for sharing the documents.

I tried to create certificates using HMAC Authentication method. But not able to create successfully.

Logs:

2025-08-01 11:07:47,475+0000 DEBUG [org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory] (default task-1) java.sql.Connection#endRequest has been invoked
2025-08-01 11:07:47,476+0000 DEBUG [org.ejbca.core.protocol.cmp.CrmfMessageHandler] (default task-1) Found username: SERVERS
2025-08-01 11:07:47,476+0000 DEBUG [com.keyfactor.util.keys.KeyTools] (default task-1) MaxAllowedKeyLength for DES is: 2147483647
2025-08-01 11:07:47,477+0000 DEBUG [com.keyfactor.util.StringTools] (default task-1) Using encrypted CmpConfiguration
2025-08-01 11:07:47,477+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.VerifyPKIMessage] (default task-1) Trying to verify the message using CMP authentication module 'HMAC' with parameter '-'
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpPbeVerifyer] (default task-1) Protection type is: 1.2.840.113533.7.66.13
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpPbeVerifyer] (default task-1) Iteration count is: 1000
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpPbeVerifyer] (default task-1) Owf type is: 1.3.14.3.2.26
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpPbeVerifyer] (default task-1) Mac type is: 1.2.840.113549.2.7
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Verifying HMAC in Client mode
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Searching for an end entity with username='SERVERS'.
2025-08-01 11:07:47,478+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac120002:-15353949:6889ed4c:761f status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2025-08-01 11:07:47,478+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac120002:-15353949:6889ed4c:761f status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Comparing HMAC password authentication for user 'SERVERS'.
2025-08-01 11:07:47,479+0000 INFO [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Authentication failed for message. SERVERS.
2025-08-01 11:07:47,479+0000 INFO [org.ejbca.core.protocol.cmp.CrmfMessageHandler] (default task-1) Authentication failed for message. SERVERS.
2025-08-01 11:07:47,480+0000 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-1) 2025-08-01 11:07:47+00:00;ACCESS_CONTROL;SUCCESS;ACCESSCONTROL;CORE;cmpProtocolSignErrorResponse;;;;resource0=/ca/278366771
2025-08-01 11:07:47,480+0000 DEBUG [org.cesecore.audit.log.InternalSecurityEventsLoggerSessionBean] (default task-1) LogDevice: Log4jDevice Proc: 0
2025-08-01 11:07:47,480+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac120002:-15353949:6889ed4c:761f status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2025-08-01 11:07:47,480+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac120002:-15353949:6889ed4c:761f status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2025-08-01 11:07:47,483+0000 DEBUG [org.cesecore.config.CesecoreConfiguration] (default task-1) Using default value of 20 for new CA's ca.serialnumberoctetsize
2025-08-01 11:07:47,483+0000 DEBUG [org.cesecore.certificates.ca.CAData] (default task-1) CAData.getProtectString gives size: 11943
2025-08-01 11:07:47,484+0000 DEBUG [org.cesecore.config.CesecoreConfiguration] (default task-1) Using default value of 20 for new CA's ca.serialnumberoctetsize
2025-08-01 11:07:47,485+0000 DEBUG [org.cesecore.internal.CommonCacheBase] (default task-1) Update not needed X509CAImpl in cache. Digest was 867194821, cacheEntry digest was 867194821
2025-08-01 11:07:47,485+0000 DEBUG [org.cesecore.keys.token.CryptoTokenSessionBean] (default task-1) CryptoToken with ID -609943690 will be checked for updates.
2025-08-01 11:07:47,485+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: reuse entity manager session already in tx Local transaction (delegate=TransactionImple < ac, BasicAction: 0:ffffac120002:-15353949:6889ed4c:761f status: ActionStatus.RUNNING >, owner=Local transaction context for provider JBoss JTA transaction provider)
2025-08-01 11:07:47,486+0000 DEBUG [org.cesecore.internal.CommonCacheBase] (default task-1) Update not needed SoftCryptoToken in cache. Digest was 1007358840, cacheEntry digest was 1007358840
2025-08-01 11:07:47,486+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Creating a signed error message with failInfo=2, failText=Authentication failed for message. SERVERS.
2025-08-01 11:07:47,487+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpErrorResponseMessage] (default task-1) Create error message from requestType: 23
2025-08-01 11:07:47,487+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Signature algorithm: SHA256WithRSA, from signAlg SHA256WithRSA, request digest null and key algorithm: RSA
2025-08-01 11:07:47,487+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Selected signature alg oid: 1.2.840.113549.1.1.11, from signAlg SHA256WithRSA and key algorithm: RSA
2025-08-01 11:07:47,487+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageHelper] (default task-1) Signing CMP message with signature alg: SHA256WithRSA
2025-08-01 11:07:47,493+0000 DEBUG [org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean] (default task-1) Received a response message of type 'org.ejbca.core.protocol.cmp.CmpErrorResponseMessage' from CmpMessageHandler.
2025-08-01 11:07:47,494+0000 DEBUG [org.jboss.as.jpa] (default task-1) default task-1:transaction scoped EntityManager [ejbca.ear#ejbca]: closing entity managersession
2025-08-01 11:07:47,494+0000 DEBUG [org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory] (default task-1) java.sql.Connection#endRequest has been invoked

Can you help me or guide me what I am doing wrong

[primetomas]

You have an end entity called SERVERS, which isn't configured with a "Batch generation (clear text pwd storage)" that is the same as you use for HMAC when you create the message.

Hence the log entries:

2025-08-01 11:07:47,478+0000 DEBUG [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Comparing HMAC password authentication for user 'SERVERS'.
2025-08-01 11:07:47,479+0000 INFO [org.ejbca.core.protocol.cmp.authentication.HMACAuthenticationModule] (default task-1) Authentication failed for message. SERVERS.

[pragya1998hal]

I had already configured with a "Batch generation (clear text pwd storage). Still facing same issue

[primetomas]

How are you creating your HMAC protection then?