My company is migrating its CAs. Actually, it's Unicert CA using a UPI client. But in the future, they want a CA supporting CMP (it should be EJBCA, I'm actually testing this).

So I analyzed the CMP and CRMF protocols. I can see all the basic stuff like register, revoke, change key pair. But how to simply retrieve information? I mean, for example, how to get the already generated certificate if we know the serial number ?

The actual implementation we have can do it. BTW, it doesn't use CMP. But strictly using the CMP protocol, is it possible to do it ?
I can easily find workarounds here, but I'm trying to be as close as possible to the actual implementation we have.


There is no obvious standard for retrieving already generated certificiates using CMP. In RFC4120 there is the PKI Information Request, https://www.rfc-editor.org/rfc/rfc4210#section-6.5, but this is rather generically described without standardized methods for getting this information. EJBCA does not support retrieving this information through CMP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.