EJBCA CLI Operations¶

Use the EJBCA CLI (ejbca.sh) inside the EJBCA container to perform administrative operations. The CLI communicates using internal EJB calls and therefore does not require application-level authentication. However, you must have cluster-admin privileges in Kubernetes to run kubectl exec commands.

This section covers common tasks such as managing certificate authorities, certificate profiles, and CMP aliases using the CLI.

Available Operations (Community Edition)¶

Many operations are available via the CLI, some of which can only be done using the CLI (or Admin GUI). The following table summarizes some of the EJBCA operations and indicates whether each operation can be performed using the CLI, Admin GUI, or both.

Operation	CLI	Admin GUI
Import external CA certificates — `ejbca.sh ca importcacert`	Yes	No
Sign CSRs (without a pre-created end entity) — `ejbca.sh createcert`	Yes	No
Set up superadmin authorization — `ejbca.sh roles initauthorization`	Yes	No
Create Certificate Authorities — `ejbca.sh ca init`	Yes	Yes
Edit certificate profiles — `ejbca.sh ca editcertificateprofile`	Yes	Yes
Create end entities — `ejbca.sh ra addendentity`	Yes	Yes
Configure CMP aliases — `ejbca.sh config cmp addalias/updatealias`	Yes	Yes
Create certificate profiles	No	Yes
Create end entity profiles	No	Yes

Access the CLI ¶

Run the following command to open an interactive shell session inside the EJBCA container and access the CLI directly.

~(keystone_admin)]$ kubectl exec -it ejbca-0 -n ejbca -c ejbca -- /opt/keyfactor/bin/ejbca.sh

CLI Operation Examples ¶

The following shows some examples of CLI operations that can only be done by CLI and the Admin GUI.

Note

In the following examples, replace the placeholder password changeit with a strong, unique password.

Create a CA¶

$ export NAMESPACE="ejbca"
$ export EJBCA_POD="ejbca-0"
$ export CONTAINER="ejbca"
$ export E="/opt/keyfactor/bin/ejbca.sh"
$ export CA_NAME="test-ca"
$ export CA_TOKEN_PASS="changeit"

~(keystone_admin)]$ kubectl exec -it ${EJBCA_POD} -n ${NAMESPACE} -c ${CONTAINER} -- $E ca init \
    --caname ${CA_NAME} \
    --dn "CN=${CA_NAME}" \
    --tokenType soft \
    --tokenPass ${CA_TOKEN_PASS} \
    --keytype RSA \
    --keyspec 4096 \
    -v 3650 \
    --policy null \
    -s SHA256WithRSA \
    --signedby 1

Note

Replace the placeholder password changeit with a strong, unique password.

Create a CMP Alias¶

Before you create a CMP alias, create the certificate profile and end entity profile in the Admin GUI. To automate profile management across deployments, use the CLI commands ca exportprofiles and ca importprofiles to export and import profiles. You can also import profiles from a reference EJBCA system.

Note

Replace the placeholder password changeit with a strong, unique password.

$ export CERT_PROFILE="test-cert-profile"
$ export EE_PROFILE="test-entity-profile"
$ export CMP_ALIAS="cmp-test-alias"
$ export CMP_HMAC_SECRET="changeit"

# Create the alias
~(keystone_admin)]$ kubectl exec ${EJBCA_POD} -c ${CONTAINER} -n ${NAMESPACE} -- $E config cmp addalias \
     --alias ${CMP_ALIAS}

# Configure the alias parameters
$ for kv in \
    "operationmode ra" \
    "authenticationmodule HMAC" \
    "authenticationparameters ${CMP_HMAC_SECRET}" \
    "responseprotection pbe" \
    "defaultca ${CA_NAME}" \
    "ra.certificateprofile ${CERT_PROFILE}" \
    "ra.endentityprofile ${EE_PROFILE}" \
    "ra.namegenerationscheme DN" \
    "ra.caname ${CA_NAME}"; do
  ~(keystone_admin)]$ kubectl exec ${EJBCA_POD} -c ${CONTAINER} -n ${NAMESPACE} -- \
    $E config cmp updatealias \
    --alias ${CMP_ALIAS} --key ${kv%% *} --value "${kv#* }"
done

# Verify the configuration
~(keystone_admin)]$ kubectl exec ${EJBCA_POD} -c ${CONTAINER} -n ${NAMESPACE} -- \
    $E config cmp dumpalias --alias ${CMP_ALIAS}

Note

For the complete CLI command reference, see: https://docs.keyfactor.com/ejbca/latest/ejbca-operations/ejbca-cli-reference.

Related Information