There was a problem during the installation. I don't know what went wrong , access the CA UI

[Finnimbrun]

There was a problem during the installation. I don't know what went wrong , access the CA UI: https://x.x.x.x:8443/ejbca/adminweb/

[mike-agrenius-kushner]

Hi,

Looks like your keystore hasn't been succesfully deployed to WildFly. There may be additional steps you may need to take depending on your WF-version, but before anything else, run:

ant deploy-keystore

and then restart Wildfly, see https://doc.primekey.com/ejbca/ejbca-installation/installing-ejbca/installing-ejbca-as-a-ca-with-a-management-ca

Cheers,
Mike

[Finnimbrun]

Thank you for your answer ,

According to your instructions ,The problem has not been solved.

WildFly version : wildfly24.0.1

My first time using wildfly,According to the installation document, i Use 3-Port Separation.

[mike-agrenius-kushner]

Right, and I'm assuming that you've followed the instructions in https://doc.primekey.com/ejbca/ejbca-installation/application-servers/wildfly-24 letter, by letter?

[Finnimbrun]

Yes, I deployed it according to the document

[Dan33l]

Hi,
I am in a situation that looks exactly the same.
I am using ejbca-ce-EJBCA_7_9_0_2_20220616 and wildfly-24.0.1.Final.
Excepted i used full Wildfly instead of Galleon. I am using 2 ports separation.

I enabled DEBUG level on many logger categories, but i was unable to get information about what is going wrong in server.log.

Help will be appreciated.

@CoreCodeJOJO did you found a solution ?

[Dan33l]

I used tcpdump to spy TLS. I can see "client hello' and 'server hello' but then the handshake is aborted.

Before installing EJBCA the default welcome website with self signed certificate was responding.
EJBCA is installed also with selfsigned certificate when we follow https://doc.primekey.com/ejbca/ejbca-installation/application-servers/wildfly-24 ?

[Dan33l]

SInce i suppose the issue is related to keystore, i read the configuration file standalone/configuration/standalone.xml. In it section named tls, i can read :

                    <key-store name="httpsKS">
                        <credential-reference store="defaultCS" alias="httpsKeystorePassword"/>
                        <implementation type="PKCS12"/>
                        <file path="keystore/keystore.p12" relative-to="jboss.server.config.dir"/>
                    </key-store>
                    <key-store name="httpsTS">
                        <credential-reference store="defaultCS" alias="httpsTruststorePassword"/>
                        <implementation type="PKCS12"/>
                        <file path="keystore/truststore.p12" relative-to="jboss.server.config.dir"/>
                    </key-store>

In found in TLS configuration section of EJBCA doc the commands /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsKS:add(path="keystore/keystore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsKeystorePassword},type=PKCS12)' and /opt/wildfly/bin/jboss-cli.sh --connect '/subsystem=elytron/key-store=httpsTS:add(path="keystore/truststore.p12",relative-to=jboss.server.config.dir,credential-reference={store=defaultCS, alias=httpsTruststorePassword},type=PKCS12)'

But the standalone/configuration/keystore directory does not have a file named keystore.p12 nor truststore.p12 but keystore.jks and truststore.jks.

On the ejbca host it looks impossible to get certificat :

openssl s_client -showcerts -connect <my_ip_addr>:8443
CONNECTED(00000003)
Can't use SSL_get_servername
140230128473408:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1543:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA1:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 318 bytes and written 283 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
root@ejbca:/opt/wildfly# ss -tnlp
State              Recv-Q             Send-Q                              Local Address:Port                          Peer Address:Port             Process                                                
LISTEN             0                  80                                      127.0.0.1:3306                               0.0.0.0:*                 users:(("mysqld",pid=7296,fd=21))                     
LISTEN             0                  4096                                127.0.0.53%lo:53                                 0.0.0.0:*                 users:(("systemd-resolve",pid=640,fd=13))             
LISTEN             0                  128                                       0.0.0.0:22                                 0.0.0.0:*                 users:(("sshd",pid=1004,fd=3))                        
LISTEN             0                  4096                                            *:8080                                     *:*                 users:(("java",pid=65617,fd=501))                     
LISTEN             0                  128                                          [::]:22                                    [::]:*                 users:(("sshd",pid=1004,fd=4))                        
LISTEN             0                  4096                                            *:8443                                     *:*                 users:(("java",pid=65617,fd=557))                     
LISTEN             0                  4096                           [::ffff:127.0.0.1]:4447                                     *:*                 users:(("java",pid=65617,fd=500))                     
LISTEN             0                  50                             [::ffff:127.0.0.1]:9990                                     *:*                 users:(("java",pid=65617,fd=523))    `

I don't know what to do with this now :)

[Dan33l]

Answer to myself :
I converted the jks files p12 format, then restarted wildfly.

Now it works!

The EJBCA documentation is really awesome. And at the same time, maybe there is a place to improve. I don't know where it can be improved to avoid this issue.

[Finnimbrun]

Thanks for your try, it helped me too.
According to your instructions, I have generated the p12 file in the path /opt/wildfly/standalone/configuration/keystore. then restart the service ,and it works now.

cd /opt/wildfly/standalone/configuration/keystore
keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore keystore.p12
keytool -importkeystore -srckeystore truststore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore truststore.p12
# restart wildfly services
systemctl restart wildfly

I used to install by /ejbca-ce-EJBCA_7_9_0_2_20220616/bin/extra/ejbca-setup.sh. Although successful, it is not recommended. wildfly and mariadb is old version. Now, I can finally use the latest version.

Finally, thank you very much

[oculos]

I have the same problem with Wildfly 26, so I thought about giving a try with this recipe. I manage to generate p12 files, but when I restart my wildfly instance, so it basically complains that mariadb-java-client.jar is not available. I try to redeploy it, but it doesn't work. I describe it a bit here: #161

Any clues?

[primetomas]

Thank you. I will create an issue to update the WildFly 24 documentation.