EJBCA Admin GUI Access and Operations

To access the EJBCA Admin GUI, you must import both the CA certificate and the superadmin client credential into your browser. The Admin GUI uses mTLS for authentication.

Prerequisites

Before accessing the Admin GUI:

Export the system-local-ca Certificate

Export the CA certificate from the platform to your local machine.

~(keystone_admin)]$ kubectl get secret system-local-ca -n cert-manager \
    -o jsonpath='{.data.ca\.crt}' | base64 -d > system-local-ca.pem

Export the Superadmin Credential

Export the superadmin credential from the platform to your local machine.

$ source /etc/platform/openrc

# Extract the superadmin certificate and key
~(keystone_admin)]$ kubectl get secret ejbca-superadmin-cert -n ejbca \
    -o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/sa.crt
~(keystone_admin)]$ kubectl get secret ejbca-superadmin-cert -n ejbca \
    -o jsonpath='{.data.tls\.key}' | base64 -d > /tmp/sa.key

# Create a |P12| file to import into your browser
$ openssl pkcs12 -export \
    -out /tmp/superadmin.p12 \
    -inkey /tmp/sa.key \
    -in /tmp/sa.crt \
    -name SuperAdmin \
    -passout pass:<p12-password>

Enable mTLS Authentication

Import the credentials you exported into your browser to enable mTLS authentication.

  1. Import the CA certificate (system-local-ca.pem):

    • In Firefox, select Settings > Privacy & Security > Certificates > View Certificates > Authorities > Import.

    • In Chrome, select Settings > Privacy and Security > Security > Manage certificates > Authorities > Import.

  2. Import the superadmin credential (superadmin.p12):

    • In Firefox, select Settings > Privacy & Security > Certificates > View Certificates > Your Certificates > Import.

    • In Chrome, select Settings > Privacy and Security > Security > Manage certificates > Your Certificates > Import.

    When prompted, enter the PKCS#12 Certificate and Private Key Bundle password you set in the Export the Superadmin Credential procedure.

Access the Admin GUI

Navigate to the following URL to open the Admin GUI:

https://<ejbca-hostname>:7443/ejbca/adminweb/

When prompted, select the superadmin certificate for client authentication.

Common Admin GUI Operations

Use the Admin GUI to view and manage CAs, certificate profiles, end entity profiles, end entities, and certificates.

Operation

Navigation

View all CAs available on the platform, including the default ManagementCA and any CAs you create.

CA Functions > Certificate Authorities

View certificate profiles that define constraints such as allowed key algorithms, key sizes, extensions, and validity periods.

CA Functions > Certificate Profiles

View end entity profiles that define enrollment parameters such as allowed DNs, SANs, and associated certificate profiles.

|RA| Functions > End Entity Profiles

View existing end entities and their associated certificates.

RA Functions > Search End Entities, then select View End Entity or View Certificate

Create certificate profiles and end entity profiles to define key algorithms, validity periods, allowed DNs, SANs, and other enrollment constraints.

See Create Certificate Profiles and End Entity Profiles

Create a CA and issue a certificate using a crypto token, key pairs, and the RA Web interface.

See Create a CA and Issue a Certificate

Create Certificate Profiles and End Entity Profiles

Use certificate and end entity profiles to define enrollment constraints and parameters for certificate requests:

  1. Create a certificate profile. Select CA Functions > Certificate Profiles > Add.

  2. Configure the key algorithm, key size (for example, RSA 4096), validity period, and extensions.

  3. Create an end entity profile. Select RA Functions > End Entity Profiles > Add.

  4. Associate the profile with a certificate profile and default CA, then configure the Subject DN fields and Subject Alternative Names.

Create a CA and Issue a Certificate

Create a new certificate authority and issue a certificate using the Admin GUI.

  1. Create a crypto token. Select CA Functions > Crypto Tokens > Create new (e.g., test-ca-token with password).

  2. Generate the signing and encryption key pairs within the token.

  3. Create a CA. Select CA Functions > Certificate Authorities > Add CA > Create.

  4. Select the crypto token and signing key.

  5. To issue a certificate, select RA Web > Make New Request.

    • Select end entity profile, certificate profile, and CA.

    • Fill in the subject DN and credentials.

    • Download PKCS#12 Certificate and Private Key Bundle or Download PEM.

Note

EJBCA creates a new end entity and its certificate.

Note

For detailed information about the Admin GUI, refer to the EJBCA documentation: https://docs.keyfactor.com/ejbca/latest/ejbca-operations/ejbca-ca-ui

Related Information