I'm using the Keyfactor Docker ejbca-ce version 8.0.0 (as a test case) to request client certificates from the server over CMP (with bouncycastle) with the server-side generated keys workflow. The certificates from the clients are used to encrypt files, therefore they need to be recoverable, so all server-side generated tokens are configured to be recoverable. The issue is, all CMP requested certificates are labeled in the RA GUI as user-generated and therefore are not recoverable. The CMP message from the client does not include a private key, the answer from the server includes a private key and certificate that i can extract and use.
My workflow is similar to https://github.com/rgorosito/ejbca/blob/master/modules/systemtests/src-test/org/ejbca/core/protocol/cmp/CrmfRequestTest.java -> test12ServerGeneratedKeys.
Is there a different way to recover CMP requested keys ? Or is this some unexpected behavior ?
At the very moment my request does not contain a certificate template with unique values, i'm just sending the new user (userDN), the public key for the encryption secret and the algorithms that should be used.
I'm using the Keyfactor Docker ejbca-ce version 8.0.0 (as a test case) to request client certificates from the server over CMP (with bouncycastle) with the server-side generated keys workflow. The certificates from the clients are used to encrypt files, therefore they need to be recoverable, so all server-side generated tokens are configured to be recoverable. The issue is, all CMP requested certificates are labeled in the RA GUI as user-generated and therefore are not recoverable. The CMP message from the client does not include a private key, the answer from the server includes a private key and certificate that i can extract and use.
My workflow is similar to https://github.com/rgorosito/ejbca/blob/master/modules/systemtests/src-test/org/ejbca/core/protocol/cmp/CrmfRequestTest.java -> test12ServerGeneratedKeys.
Is there a different way to recover CMP requested keys ? Or is this some unexpected behavior ?
At the very moment my request does not contain a certificate template with unique values, i'm just sending the new user (userDN), the public key for the encryption secret and the algorithms that should be used.