Never get back the initial username and password.

[xxedgexx]

After struggling with getting the git version running, I'm trying docker. I never see the second part of Step 2:

https://doc.primekey.com/ejbca/tutorials-and-guides/quick-start-guide-start-ejbca-container-with-client-certificate-authenticated-access

It never spits out the username and password.

[xxedgexx]

I went through the install quick some time ago and I'm trying to stand up a second instance. It's been fairly difficult to get going. I tried Wildfly 26, which got further. There used to be a ejbca-setup.sh script, but I don't see this in the latest git version. I don't really want to run docker for this if I don't have to... but at this point, I'd love to just get this up and running. I'm trying to install on Rocky 9.

[xxedgexx]

Where do I find the superadmin initial password? Also, why does it seem like it's still looking for user p12 when I bring it up with -e TLS_SETUP_ENABLED="simple" per the docs?

[mike-agrenius-kushner]

The setup script wasn't being maintained and only fit for very specific environments, so it was really a "try-it-out"-tool, hence we replaced it with Docker.

But yeah, "'-e TLS_SETUP_ENABLED="simple"' is what's going to prompt EJBCA to enroll but not issue the initial superadmin. Have you tried wiping the container and creating it anew? It could be re-running on top of a previous installation you made.

[xxedgexx]

I'll try removing the image and start again without -e TLS_SETUP_ENABLED="simple".

[xxedgexx]

Wiped the image. This is all I get when starting with:

docker run -it --rm -p 80:8080 -p 443:8443 -h ca.server.corp keyfactor/ejbca-ce

2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) #######################################################################################################
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # Whenever you are ready for production: #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # Try out the commercially supported EJBCA Enterprise Cloud on AWS or Azure, fully featured with: #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # - Additional enrollment APIs such as a complete REST API, EST, ACME and more. #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # - Support for external Registration Authority and OCSP responders #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # - Hardware Security Module support #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # - Application updates #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # - ...and more! #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # Feel free to contact us directly for a cloud, on-prem, SaaS, embedded or hybrid solution that fits #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # your specific needs. #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # https://aws.amazon.com/marketplace/seller-profile?id=7edf9048-58e6-4086-9d98-b8e0c1d78fce #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # https://azuremarketplace.microsoft.com/en-us/marketplace/apps/primekey.ejbca_enterprise_cloud_2 #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # https://www.keyfactor.com #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # [email protected] #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) # #
2023-03-21 08:09:12,003+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) #######################################################################################################
2023-03-21 08:09:12,045+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) Waiting 5 seconds before signaling application readiness to ensure proper handling of PublicAccessAuthenticationToken.
2023-03-21 08:09:17,066+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) Health check now reports application status at /ejbca/publicweb/healthcheck/ejbcahealth
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1)
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) *****************************************************************************************
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * A fresh installation was detected and a ManagementCA was created for your initial *
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * access to the system. *
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * *
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * URL: https://ca.server.corp:443/ejbca/adminweb/
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * *
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) * If you use different port mapping or a proxy, please adapt the URL above accordingly. *
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1) *****************************************************************************************
2023-03-21 08:09:17,082+0000 INFO [/opt/keyfactor/bin/start.sh] (process:1)

[xxedgexx]

I have it up and running. I think this was a browser issue from previously rejected certificates and such. Clearing all superadmin certs I had laying around and restarting the browser allowed me to connect. I'd prefer to have it functioning with a client certificate but this will do for now.

[svenska-primekey]

Use -e TLS_SETUP_ENABLED="true" to use mtls to access EJBCA.

[xxedgexx]

Use -e TLS_SETUP_ENABLED="true" to use mtls to access EJBCA.

Thanks. So if I started the container with "simple", and I restart the container with "true", how do I retrieve the superadmin.p12 cert for my browser and where will I find the password? Is there another way to get this information or turn this on after the fact so I don't have to keep wiping out my container?

[xxedgexx]

Use -e TLS_SETUP_ENABLED="true" to use mtls to access EJBCA.

Thanks. So if I started the container with "simple", and I restart the container with "true", how do I retrieve the superadmin.p12 cert for my browser and where will I find the password? Is there another way to get this information or turn this on after the fact so I don't have to keep wiping out my container?

Nevermind. Helps to read ALL of the docs and not just some of them.

[xxedgexx]

Thanks for the help.

One more issue. I went through the process of creating the SuperAdmin account with certificate using these docs:

https://doc.primekey.com/ejbca/tutorials-and-guides/tutorial-start-out-with-ejbca-docker-container

and now that I've altered the Roles and Access Rules to restrict to the SuperAdmin user, I no longer see any of my CA's in "CA Activation". Is there some ACL I have to tweak?

[mike-agrenius-kushner]

I'd advise very strongly against tweaking the SuperAdmin user, that's your basic safety line if everything else breaks. Basically your root account. Instead, create new Roles and issue client certs for those for every day use.