EJBCA 7.0.0 Release Notes
It's not often that we get to celebrate the emergence of a major release of EJBCA, and this has been a long time coming. World, meet EJBCA 7!
So what's new you ask? New workflows? VR based UI? Is everything solved using blockchains, machine learning and quantum cryptography?
Well, we're afraid not. What we actually have done is dug down and replaced nearly all of the backing code for the UI, some of which has been around ever since EJBCA's inception back in 2002. Same old trusty EJBCA, but with a newly furnished engine. While this may sound a bit lackluster at first glance, this is the first major beachhead that will allow the PrimeKey team to start making great strides in improving EJBCA's user experience for our customers and their clients. This is not the end, but the start of an exciting new journey.
Technology Leap to JDK8/JEE7
Probably the most impactful change of upgrading to EJBCA 7 is that we're dropping support of JDK7, and by extension JEE6 reliant application servers. In essence, from here on in that means that the minimum supported application server is JBoss EAP7/Wildfly 10. If your current installation is running on an earlier JDK or application server we recommend upgrading those first, going through an intermediate release of EJBCA if necessary. The EJBCA Upgrade Guide has detailed instructions for which workflow to follow if this applies to you.
This leap is partly motivated by the end of professional support for JDK7 from Oracle coming this summer, but also because it both allows us to upgrade older libraries (which have long since ceased receiving security updates) and to be able to make use of much of the newer technology which has been developed in the intervening years in order to improve your user experience.
JDK11 Support
While not completely tried and tested yet, we've begun implementing support for JDK11, and have it working in our test environment. For production environments, we recommend sticking to JDK8 for the time being, but for the adventurous among you, we would by all means appreciate any feedback.
Roadmap Update
Deprecating the Public Web and slimming down the CA Web UI
As mentioned above, we're heading into an exciting new era for EJBCA. The time has come for us to finally begin deprecating old functionality, and as we have mentioned before, two primary sections are on the chopping block: RA functionality in the CA Web and the Public Web, with the intent of them being fully replaced by the RA Web. Our goal in the coming months is to replicate the remaining missing features in the RA Web (we're nearly there), and further improve workflows in order to minimize context switching between the UIs, leading to a more natural user experience for EJBCA administrators. Once we feel secure that this is done we're going to perform a soft drop of the pages (hiding them by default, but still making them available if needed) before dropping them entirely in the long term. If your workflows still rely on those two feature sets, we recommend taking a look at the RA Web.
Appliance Release
EJBCA 7 (or a later minor release) will be included in Appliance version 3.3.0 and is scheduled towards the end of Q1.
Upgrade Information
Read the EJBCA Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.
Change Log: Resolved Issues
For full details of fixed bugs and implemented features in EJBCA 7.0.0, refer to our JIRA Issue Tracker.
New Features
ECA-3076 - Detect and audit log when an administrator logs out of the CA Web UI
ECA-6777 - Create new DB column for storing CSR in CertificateData
ECA-7225 - Note in approvals that values have been changed from the default
ECA-7256 - Allow the creation of unenrolled EEs from the RA Web
ECA-7339 - PSD2 ASN.1 module and API code
ECA-7383 - Core API support for multi-value RDN and End Entity Profile validation of multi-value RDNs
ECA-7401 - Implement ConfigDump export for MultiGroupPublisher
ECA-7413 - Add SHA348withRSAandMGF1 and SHA512withRSAandMGF1 to the list of selectable signature algorithms
ECA-7414 - Make EJBCA build with Java 11
ECA-7419 - Can't paste ACME root anchor with tabs
ECA-7440 - Configdump exports parts of ACME configuration even if excluded
ECA-7444 - User Data Source access control does not let superadmins select "Any CA"
ECA-7470 - Possibility to add array values in edit CA CLI
ECA-7539 - Add subcommand to clientToolBox to interact with database over pure JDBC
ECA-7556 - ClientToolBox command for running a health check
ECA-7562 - Add WS CLI method to get remaining number of approvals
ECA-7586 - Implement a session timeout from the CA Web UI
Improvements
ECA-3724 - Convert Certificate Profiles pages to JSF
ECA-4348 - Remove remaining NetID integration code
ECA-4377 - CertTools.isCertificateValid logging refers to OCSP.
ECA-4630 - Convert Edit End Entity Profile page to JSF
ECA-5804 - Make ApprovalSessionTest less timing sensetive
ECA-5851 - Convert Certificate Authority pages to JSF
ECA-5932 - Upgrade bundled Hibernate jars
ECA-6210 - Stop using Ejb3Configuration in DatabaseSchemaScriptCommand
ECA-6801 - Convert EJBCA Home page to JSF
ECA-6802 - Convert CA Activation Page to JSF
ECA-6803 - Convert CA Structure & CRLs page to JSF
ECA-6804 - Convert Edit Crypto Tokens page to XHTML
ECA-6805 - Convert Manage Crypto Tokens page to XHTML
ECA-6806 - Convert Manage Publishers page to JSF
ECA-6807 - Convert Edit Publishers page to JSF
ECA-6808 - Convert Manage End Entity Profiles page to JSF
ECA-6810 - Convert Manage User Data Sources page to JSF
ECA-6811 - Convert Edit User Data Source page to JSF
ECA-6812 - Convert Manage Hard Token Issuers page to JSF
ECA-6813 - Convert Edit Hard Token Issuers page to JSF
ECA-6816 - Convert Manage Approval Profiles page to XHTML
ECA-6817 - Convert Edit Approval Profile page to XHTML
ECA-6818 - Convert Audit Log page to XHTML
ECA-6819 - Convert Manage Keybindings page to XHTML
ECA-6820 - Convert Edit Keybindings page to XHTML
ECA-6821 - Convert Manage Peer Connectors page to XHTML
ECA-6822 - Convert Edit Peer Connectors page to XHTML
ECA-6824 - Convert Manage Services page to XHTML
ECA-6825 - Convert Edit Services page to XHTML
ECA-6826 - Convert Manage CMP Aliases page to JSF
ECA-6827 - Convert Edit CMP Alias page to JSF
ECA-6828 - Convert Manage EST Aliases page to JSF
ECA-6829 - Convert Edit EST Alias page to JSF
ECA-6830 - Convert Manage SCEP aliases page to XHTML
ECA-6831 - Convert Manage SCEP alias page to XHTML
ECA-6832 - Convert System Configuration page to XHTML
ECA-6833 - Convert Preferences page to JSF
ECA-7263 - Remove "Administration" title from CA UI
ECA-7276 - Database CLI import from XML format
ECA-7284 - Fix broken web tests for JSF conversion
ECA-7289 - Improvements to Certificate Transparency section in certificate profiles
ECA-7292 - Add proper error handling for JSF
ECA-7298 - EJBCA CLI's "Merge CA Tokens" leaves unused crypto tokens behind
ECA-7312 - Increase initial size of ProtectionStringBuilder for Certificate Profiles to avoid unessecary warnings in debug log
ECA-7313 - Change mime type for CRLs from application/x-x509-crl to application/pkix-crl as defined in RFC5280
ECA-7314 - Implement "Custom Certificate Extension Data" field for RA enrollment
ECA-7315 - findCertificatesByExpireTime API calls, CLI and RA UI, should not return already expired certificates
ECA-7317 - SCEP error messages when CA can not be found are not complete
ECA-7325 - Extend tests for Custom Certificate Extensions
ECA-7327 - Convert viewcainfo.jsp and viewcertificate.jsp popUps to jsf
ECA-7334 - Review End Entity Profiles UI Tests
ECA-7343 - Refactor org.ejbca.webtest.helper.CaHelper
ECA-7344 - Refactor org.ejbca.webtest.helper.AdminRolesHelper
ECA-7348 - Introduce a CaStructureHelper for UI tests
ECA-7355 - Review Convert CA Structure & CRLs UI tests
ECA-7356 - Introduce an ApprovalProfilesHelper for UI tests
ECA-7357 - Review Approval Profiles UI tests
ECA-7362 - Review Administrator Roles UI Tests
ECA-7365 - Add a Jenkins job for EJBCA UI Tests
ECA-7367 - Acme must be in status unavailable under System Configuration (community edition)
ECA-7371 - Usage of sun.security.pkcs11 is not allowed when compiling in Java 11
ECA-7375 - Crypto Tokens page messages are displayed twice.
ECA-7380 - Missing space between 'Title' and '?' in Manage Crypto Tokens page
ECA-7421 - configdump module's unit tests are not collected by Jenkins unit tests job 'EJBCA_TRUNK_UNIT_PUPPET'
ECA-7423 - Failing tests of org.ejbca.configdump.core.ConfigdumpCoreUnitTest
ECA-7437 - Clean up unused imports, parameterize, remove unused variables ect.
ECA-7456 - VendorAuthenticationTest.test01_3GPPMode depends on server time zone
ECA-7471 - Allow system tests to run with EJBCA not on localhost
ECA-7491 - Use relative URLs in AdminGUI
ECA-7492 - Fun refactoring task - WebLanguages class uses property arrays, but should be remade in more OOP way
ECA-7508 - EJBCA-CLI: Do not add duplicate role members
ECA-7514 - Fix failing tests in EjbcaRestHelperUnitTest
ECA-7518 - Allow tests to run with TLS certificates not issued by ManagementCA
ECA-7522 - Add proper configuration to jenkins-files/*/conf/
ECA-7527 - Investigate and fix ACME failing tests in trunk
ECA-7530 - Convert ACME Configuration page to xhtml
ECA-7531 - Convert ACME Alias Configuration page to xhtml
ECA-7532 - Add Deviation List Signer Extended Key Usage
ECA-7537 - Simplify and improve configuration of CMP tests
ECA-7541 - Change CT log policy labels to not use mathematical symbols
ECA-7546 - Make API and log use of requestID and approvalID consistent and easier to understand
ECA-7547 - Allow OCSP KeyBinding certificate without Key Usage
ECA-7555 - Acme SystemTest(s) failure for 6.15X EJBCA_TRUNK_DB2V105_UBUNTU1204_JBOSSEAP61_PUPPET jenkins job
ECA-7557 - Fix failing CMP TCP system tests
ECA-7563 - Separate out EjbcaWSTest.test02FindUser into its own test class
ECA-7566 - EjbcaWS.findUser() does not work for subjectEmail
ECA-7567 - Allow browser binary to be configured for Web Tests
ECA-7573 - Improve error handling and remove dead code in AdminWeb
ECA-7574 - Convert Approval Actions page to XHTML
ECA-7575 - Convert Approval Action page to XHTML
ECA-7576 - Clarifications in the Multi Group Publisher documentation
ECA-7579 - Editing EE functionality in RA Web is hidden behind the View-button
ECA-7594 - fun refactoring task: ViewCertificateManagedBean parseRequest method needs the button control logic refactored out into their own methods
ECA-7604 - Get rid of PublisherDataHandler class
ECA-7605 - Fix admin-gui build.xml
ECA-7609 - Clear hibernate cache in ejbca-db-cli to avoid high memory usage
ECA-7612 - VendorAuthenticationTest test case fail in Jenkins
ECA-7614 - Implement ECAQA-196 test scenario.
ECA-7616 - Code refactoring in MultiGroup Publisher Data class.
ECA-7625 - Stop using System.lineSeparator, except for writing to files or pipes
ECA-7634 - ACME test improvements
ECA-7636 - Update system requirements in documentation
ECA-7642 - WebEjbcaClearCacheTest should be skipped if not running on localhost
ECA-7643 - EjbcaWSTest should not use hardcoded "superadmin" user
ECA-7644 - EJBCA ziprelease should not include scripts from jenkins-files
ECA-7645 - CrmfRAPbeRequestTest fails on community edition
ECA-7648 - EE_COS7_OpenJDK8_WF10_NOHSM_DB2 job failure
ECA-7649 - POC Automate profiles installation for Firefox
ECA-7650 - Ability to upload CT log key in raw B64 format
ECA-7654 - Update '© 2002–2018 PrimeKey Solutions AB' to 2019
ECA-7658 - Use white-list instead of black-list of allowed HTTP methods in web.xml
ECA-7679 - PeerConnectionsTest uses TLSv1, but should use TLSv1.2
ECA-7680 - PatternLoggers should check if log level is enabled before doing work
ECA-7682 - PeerConnectionsTest.testPublishCertificate should inform about prerequisite in failure message
ECA-7684 - Typo in error message on 'View Certificate' page
ECA-7689 - Update web.xml to Servlet 3.1 use correct JSF 2.2 schema in faces-config.xml
ECA-7692 - Add CSRs for unit testing the RSA Key Validator
ECA-7694 - Modify application.xml to reflect new JEE7 version
ECA-7696 - Add method to get filename from uploaded file
ECA-7701 - Upgrade persistence.xml to JEE7
ECA-7705 - AutoEnrollment Documentation Improvement
ECA-7707 - HttpMethodsTest.testDocs should not fail if internal docs are not used
ECA-7738 - JDK11 Compliance: Patch CESeCore with provider fix from DSSINTER-289
ECA-7740 - Simplify ant build scripts to cut build time
ECA-7755 - The copyright year should be updated to include 2019
ECA-7761 - Minor security improvement
Bug Fixes
ECA-6865 - Failure to publish to a Peer Publisher gives no error message in log in some cases
ECA-7013 - RA Style is deselected while modifying access rules
ECA-7269 - Regression: JSF errors on JBoss AS 7.1.1
ECA-7273 - Certificate profiles appear to be (but aren't) editable for an Auditor
ECA-7282 - Poor error message for incorrectly formatted CT public keys: "Extra Data Detected in Stream"
ECA-7285 - Add HEAD request for the endpoint revokeCert
ECA-7286 - Fix NPE which happens when de-registering account with certbot
ECA-7326 - Bound Certificate under Internal Key Binding is displayed wrongly
ECA-7329 - NPE when you click on 'Republish' button on View Certificate page under Authentication Key Binding
ECA-7332 - OCSP Extensions configurations is applied to the newly created ones
ECA-7338 - Regression: clearPwd flag on WS editUser does not work
ECA-7342 - Check for legal characters is not working for some pages
ECA-7366 - dncomponents.properties.sample order of orgaizationIdentifier differs from default in DnCompoonents.java
ECA-7370 - ServiceManifestBuilder does not run with Java 11
ECA-7378 - PublicWeb check certificate status inly works with 8 octet cert serialNumber
ECA-7379 - Regression: throwing checked Exceptions from postConstruct is not allowed in JEE spec
ECA-7404 - CA Activation backlink broken
ECA-7433 - Dry-run parameter not respected when importing validators using Statedump
ECA-7434 - Add modular protocol configuration to Statedump
ECA-7438 - NullPointerException in some Adminweb pages if External Script Access is disabled and you have Custom Publishers
ECA-7443 - CAs and Fields in User Data Sources are stored as strings, causing ClassCastException
ECA-7445 - Missing exclude option for Validators in Statedump
ECA-7460 - NPE when importing a CA where a previous certificate exists without expireDate
ECA-7480 - When creating an EndEntity in RA Web and delete_end_entity accessrule is disabled, the process ends incorrectly with success but end entity is not created
ECA-7499 - java.lang.IllegalStateException when using browser back/forward button
ECA-7500 - Certificate Request Generated despite choosing the wrong format
ECA-7511 - EjbcaWSHelperSessionBean.caRenewCertRequest lacks an null check
ECA-7516 - Investigate and fix duplicate ID exception in editservice.xhtml
ECA-7523 - Test failures in ProtocolOcspHttpTest due do missing cleanup
ECA-7524 - Regression: HttpMethodsTest fail because of unexpected HTTP header value
ECA-7525 - Domestic / Non-external CVCA/DVCA do not have the expiration field set
ECA-7529 - OcspExtensionsTest fails on community edition
ECA-7533 - Fix WS documentation for isApproved and getRemainingNumberOfApprovals
ECA-7534 - DnFieldDumpHandler missing DnFieldExtractor.URI in Map.
ECA-7535 - Regression: Upgrade of customcertextensions.properties fails
ECA-7536 - CertificateCrlReaderSystemTest fails on Windows
ECA-7540 - Importing a CVCA certificate with error triggers CSRF error
ECA-7543 - CertSafePublisherTest fails on Windows due to line endings
ECA-7544 - Fix UpgradePublisherTest
ECA-7550 - Missing label and fields cleared erroneously in Edit Services page
ECA-7552 - StatedumpTest should use systemtests.properties
ECA-7558 - Admin Web returns redundant security headers
ECA-7568 - OCSP unathorized (6) error adds blank line to OCSP transaction log
ECA-7572 - Publisher queue status on home page looks weird since JSF conversion
ECA-7583 - Regression: Errors when creating a CA are not handled
ECA-7584 - USERAUTH fail when publishing with the SCP Publisher
ECA-7587 - Fix NPE when exception lacks an error message
ECA-7591 - Configdump CA is missing support for getLatestSubjectDN
ECA-7595 - UpgradeSessionBeanTest.testUpgradeOcspExtensions6120 fails intermittently
ECA-7599 - AcmeConfigurationAndValidationSystemTest.leaveRevocationReasonUnchanged fails intermittently
ECA-7611 - Fix validity field in Edit CA page
ECA-7613 - CertificateCrlReaderSystemTest fails intermittently
ECA-7615 - Multigroup publisher errors handled incorrectly after conversion
ECA-7624 - Fix ConfigdumpValidatorUnitTest and YamlWriterUnitTest
ECA-7628 - configdump change causes test build failure in CE
ECA-7631 - Typo in Error message
ECA-7632 - RA Web enrollment, End entity removed if finishUser is unchecked in the CA
ECA-7647 - 'Receive Certificate Response' does not work for Externally signed CA
ECA-7662 - SecurityEvents*SessionBeanTest fails on H2 dues to use of ORDER in DELETE
ECA-7663 - CertificateRetrievalTest.test09FindWithMissingCertData assumes database.useSeparateCertificateTable=false
ECA-7665 - OutgoingPeerConnectionTest fails intermittently
ECA-7667 - Invalid single quotes in language file
ECA-7669 - The certificate link of an 'EJBCA Node Start' row in the Audit Log does not work
ECA-7676 - Nullcheck would have been NPE in BlacklistEntry
ECA-7677 - PeerConnectionsTest is missing slf4j runtime dependency
ECA-7697 - Regression: Default 'RA-Administrator' and 'Supervisor' roles gets 'Authorization Denied Cause: You are not authorized to view this page.'
ECA-7698 - Update example URL for external documentation
ECA-7699 - Can't access Admin web index page without /ca_functionality/view_ca access
ECA-7712 - Cannot save end entity profile where End Entity E-mail is disabled
ECA-7715 - Regression: Peer connectors cached in browser session not updated when cloning
ECA-7716 - Replace invalid double quotes in language files
ECA-7721 - Regression: CMP RA Name Generation Scheme don't use language strings anymore
ECA-7723 - Can't check "Critical" checkboxes on Edit CA page
ECA-7726 - Non-informative error message on Edit EST Aliases page
ECA-7730 - Clicking Logout in Adminweb gives NumberFormatException
ECA-7735 - Cloning a peer connector does not clone the flag for process incoming requests
ECA-7737 - Certificate of type "Sub CA" can't be published
ECA-7741 - Update tag library schemas for JEE7 in AdminWeb
ECA-7742 - CAA Validator fails DNSSEC validation for CH domains
ECA-7760 - ScpPublisher: Destination URL for certificates saved as crl.scp.destination and vice versa
ECA-7767 - Configdump validator export can fail with NPE
ECA-7769 - Fix warnings from DB CLI
Tasks
ECA-6864 - Set up a Jenkins instance to test JDK8/Wildfly10 using Docker
ECA-7261 - Map which ECAQA automatic tests which need to be remapped
ECA-7275 - Test ACME wildcard cert issuance and pre-authorization with certbot.
ECA-7331 - Verify if Swagger UI for works for ACME API. If it does, add documentation to confluence. If not, hide the ACME part from swaggerUI
ECA-7545 - New Docker job on Jenkins - EE_COS7_OpenJDK8_WF10_NOHSM_DB2
ECA-7551 - Exploratory testing on CMP configuration page
ECA-7695 - Update persistence.xml and orm-dbtype.xml to reflect JEE7 version
ECA-7763 - Test upgrade from 6.15.0 to 7.0.0
ECA-7768 - Update readme with license information for Hibernate jars