2

My company is migrating its CAs. Actually, it's Unicert CA using a UPI client. But in the future, they want a CA supporting CMP (it should be EJBCA, I'm actually testing this).

So I analyzed the CMP and CRMF protocols. I can see all the basic stuff like register, revoke, change key pair. But how to simply retrieve information? I mean, for example, how to get the already generated certificate if we know the serial number ?

The actual implementation we have can do it. BTW, it doesn't use CMP. But strictly using the CMP protocol, is it possible to do it ?
I can easily find workarounds here, but I'm trying to be as close as possible to the actual implementation we have.

Improve this question
1
  • Nowadays I'd rather recommend to use ACME as enrollment protocol. I don't know your PKI clients though.
    – Michael Ströder
    Nov 12, 2022 at 15:39

2 Answers 2

Reset to default
1

There is no obvious standard for retrieving already generated certificiates using CMP. In RFC4120 there is the PKI Information Request, https://www.rfc-editor.org/rfc/rfc4210#section-6.5, but this is rather generically described without standardized methods for getting this information. EJBCA does not support retrieving this information through CMP.

Improve this answer
0

In my experience, this is usually delegated to another component. The PKI environments I dealt with had a directory (e.g., OpenLDAP), where the CA would store the certificates it issued.

The directory can be queried using protocols, such as LDAP. The syntax enables you to express complex search criteria and is very flexible. This way, you decouple the problem of certificate storage from the rest of the things a CA does.

Another benefit of this is that when a CA supports other protocols, besides CMP, then you can find a certificate regardless of which protocol was used to request it in the first place.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .