I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this.

I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to implement this on EJBCA but it is not that obvious.

I'm thinking of implementing the following:

    • This role does not have a lot of things to do on the administration interface.
    • He can configure process for approving certificate generation and revocation and CA activation.
    • Read-Only Access
    • As the name indicates, CA administration
    • PKCS11 session
    • CRL Generation & publication
    • Certificate profiles configuration & maintenance
    • etc ...
    • Manages End Entites
    • Approve/reject End Entites certification requests (revocation requests)
    • Manages End Entities Profiles (DN, notifications to end users and other administrator, EE accounts)
    • This role can be further divided to (registration officer & revocation officer)
  • API
    • Authorize applications to use API to generate certificates
  • Automatic Enrollment Protocoles
    • For SCEP, CMP ... etc
    • SSH access to the CA Server
    • Technical configuration & maintenance of the CA server
    • Can use ejbca-cli.sh, so basically he/she can be a super administrator which defeats the whole purpose of these roles.

Is this correct ? any improvements or recommendations ?

Thank you

1 Answer 1


Seems like the whole exercise will depend on your business needs. You probably need to think of those first and then choose a suitable architecture, https://doc.primekey.com/ejbca/ejbca-introduction/ejbca-architecture. Regardless of your choice, here are some thoughts regarding roles.

  • Security Officer, as you pointed out, is a business role so, you probably don't need a separate user group for that.
  • Automatic Enrollment should be part of the API.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .