EJBCA 7.12 Release Notes
APRIL 2023
The EJBCA team is pleased to announce the release of EJBCA 7.12. This release adds support for CRL Invalidity Date in CRL entries as well as performance improvements and bug fixes.
Deployment options include EJBCA Hardware Appliance, EJBCA Software Appliance, and EJBCA Cloud.
Highlights
CRL Invalidity Date
EJBCA now supports CRL Invalidity Date, a non-critical extension for CRL entries that allows administrators to specify a date for CRL entries on which it is known or suspected that the private key was compromised.
For more information on the CRL Invalidity Date extension , see CRL Generation or refer to RFC 5280: Internet X. 509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile (section 5.3.2).
Announcements
Deprecations
The following legacy functionality in EJBCA is now deprecated and will be removed in the next major release:
Asynchronous CMP Proxy. Customers previously using the CMP Proxy are advised to migrate to RA Validation of CMP messages in a peer-connected CA/RA setup. For more information, see CMP Proxy.
Asynchronous SCEP Proxy. The external RA SCEP server functionality is deprecated and we recommend proxying SCEP requests synchronously through an RA using Peers instead, see Legacy External RA SCEP Server.
End Entity printing functionality (see Printing of User Data)
CMS signing for Audit Logs. Customers are recommended to use the built in Integrity Protected Security Audit Log or external tools for audit log signing. (see Signing Exported Log Files)
ECDSA ImplicitlyCA (see ECDSA Keys and Signatures)
Upgrade Information
Review the EJBCA 7.12 Upgrade Notes for important information about this release. For upgrade instructions and information on upgrade paths, see Upgrading EJBCA.
EJBCA 7.12 is included in EJBCA Hardware Appliance 3.11.3, EJBCA Software Appliance 2.3.3 and EJBCA Cloud 3.1.0.
Change Log: Resolved Issues
The following lists fixed bugs and implemented features in EJBCA 7.12.
Issues Resolved in 7.12
Released April 2023
New Features
ECA-11253 - New column in CertificateData in invalidityDate
ECA-11254 - Add support for CRL extension "Invalidity Date"
ECA-11255 - Extend revocation REST endpoint with invalidity date
ECA-11256 - CRL generation with invalidity date
ECA-11304 - Add checkbox in Edit CA: "Allow invalidity date"
ECA-11322 - Modify the order of certificate extensions in a Certificate Profile
ECA-11411 - Support SCEP RFC8894 CACaps with AES plus RSAES-OAEP
Improvements
ECA-11334 - EC Certificate Issuance Performance Issues
ECA-11336 - Display invalidity date in RA-web search certificate view
ECA-11354 - Update to commons-fileupload-1.5.jar due to CVE-2023-24998
ECA-11379 - Unnecessary resize required during clone of HashMap in EndEntityProfile
ECA-11415 - Add ServletFileUpload.setFileCountMax in request_result.jsp
Bug Fixes
ECA-10286 - IPv6 addresses are not parsed from CSRs
ECA-10703 - Improving the log entry when publishing CRL but not storing them in db
ECA-11175 - Nullpointer when refreshing OAuth bearer token
ECA-11238 - Upgrade to 7.11.0 and Manage Requests generated an error
ECA-11240 - ClientToolBox OCSP command fails if server is configured to use nonce
ECA-11259 - Null Pointer Exception when doing configdump.sh import (p11ng)
ECA-11272 - Unable to create/handle Authenticated CSRs
ECA-11277 - Marshalling error in 7.11 with cvcRequest
ECA-11281 - CRL Updater Service Skip CA if Token Offline
ECA-11299 - Certificate view in CA UI via managed Peer cannot be closed
ECA-11301 - Cache reload causing Java out of memory error
ECA-11303 - Peer Connector - Unable to generate DH keys
ECA-11310 - Regression: p11ng module missing from ejbca-ejb-cli
ECA-11317 - Process ACME wildcard certificates in order state ready
ECA-11325 - Configdump does not allow names with slashes
ECA-11347 - Preserve SAN order when enrolling (est and others).
ECA-11351 - ejbca.sh is ignoring p11ng when importing a CA
ECA-11357 - MSAE Alias - Removing template mapping always removes the top row
ECA-11358 - MSAE "The connection test succeeds." if the default password wasn't changed
ECA-11360 - Certificate Search by Serial Number is timing out
ECA-11365 - Remote Internal Key Binding Updater service renews certificate that expires with the CA
ECA-11371 - Upgrade breaks ACME Aliases where RA Name Generation Scheme = RANDOM
ECA-11374 - Security Issue (Update library kerby-asn1)
ECA-11375 - Security Issue (Update library kerb-core)
ECA-11383 - NPE when viewing certain certificates with Private Key Usage Period extension
ECA-11384 - Static date strings fail in non UTC
ECA-11389 - ADConnectionSingletonBean - could not obtain lock within 5000MILLISECONDS
ECA-11393 - REST end entity management v2 looks to be available in Community
ECA-11403 - In "Edit CA" page "Make certificate request" button is broken
ECA-11408 - Supporting dashes in SCEP Alias names