Basic authentication after client certificate failure when attempting to access the EJBCA administrator interface.

Tomas Gustavsson — Tue, 14 Apr 2026 08:01:20 -0000

Discussions moved here. https://github.com/Keyfactor/ejbca-ce/discussions

Basic authentication after client certificate failure when attempting to access the EJBCA administrator interface.

Erlis Paula — Mon, 13 Apr 2026 20:13:49 -0000

Hello, I am attempting to restore EJBCA CE 7.11.0 on an EC2 instance running Ubuntu. I am using WildFly version 25.0.0. The issue I am encountering is that, once I have completed the entire setup process, I am able to access the web interface via port 8442; however, when attempting to access it via port 8443, the browser (Chrome on Windows 10) prompts me to select a certificate. When I select the correct certificate, the authentication appears to fail, and the system switches to an alternative authentication method, asking me to enter a username and password instead. An important detail: if I provide an incorrect certificate, the connection is denied—as expected—so the problem specifically lies with the correct certificate. I suspect this issue may be related to the WildFly version, as I followed the exact same steps I previously used with version 24.0.1, and it worked correctly back then. Here are other troubleshooting steps I have tried, all of which resulted in the same behavior:

I generated a new superAdmin.p12 file.
I reviewed the logs and did not find anything unusual.
I updated my web browser.

Error revoking certificate by EJBCA REST

Tomas Gustavsson — Tue, 18 Nov 2025 08:09:55 -0000

We're using the discussion forum at GitHub now. https://github.com/Keyfactor/ejbca-ce/

Error revoking certificate by EJBCA REST

Ruben Cortes — Mon, 17 Nov 2025 19:19:05 -0000

I have EJBCA 8.3.2 Community installed. I can create certificates using the REST API: v1/certificate/pkcs10enroll, and it works without problems. However, when I try to revoke a certificate with: /v1/certificate/{issuer_dn}/{certificate_serial_number}/revoke, as specified here: https://docs.keyfactor.com/ejbca/latest/open-api-specification, the revocation doesn't work, and the EJBCA logs don't show any errors. But when I make the request, it generates a 400 error. What else do I need to do to make the revocation work? Any help would be appreciated.

How can I change the Management CA Certificate Profile

Tomas Gustavsson — Tue, 08 Jul 2025 15:57:49 -0000

The question on GitHub was the correct place to ask questions

EJBCA-CE Docker - API enabled but not working

Muhamed K — Thu, 03 Jul 2025 12:49:40 -0000

I have the same problem. How did u fix it?

Client certificate or OAuth bearer token required

Kobus Bensch — Wed, 25 Jun 2025 16:24:01 -0000

Hi
This may no longer be required, but I thought I would post it here in case there is someone that can use this and save many hours of frustration.
If you use 3 port separation, port 8442 is for public web and 8443 is for private web. Yes I know this may be obvious, but....
In setting up EJBCA-CE I assumed that all commands need to b e run as root. This is not the case. I, after trying the docs as is, decided to install EJBCA-CE as follows:
I created a system user called wildfly on linux with a homedir as /opt/pki
Assigned sudo privs to the user and then sudoed to that user and performed the installation. Apart from one or 2 commands that require sudo privs most commands do not and the installation in general runs all the way through with no issues.

Have a great day
Kobus

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)

Tomas Gustavsson — Mon, 07 Apr 2025 08:29:52 -0000

Hi Omar,

That sounds like a question you should ask in the forum. For the benefit of the whole Community.
Unless you are a support customer, and have access to the Enterprise support system of course.

Cheers,
Tomas

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)

omar salek — Sat, 05 Apr 2025 11:31:04 -0000

Hi Tomas,

Thank you for your response.

i found the same bug on Github :

https://github.com/Keyfactor/ejbca-ce/issues/821

we’d like to confirm if any of the following approaches are valid or recommended. Your input would be greatly appreciated:

Option 1 – Exclude Log4j API using Kubernetes ConfigMap
We’re deploying EJBCA in a Kubernetes environment. One idea is to mount a volume with a custom META-INF/jboss-deployment-structure.xml file that includes:

xml
Copier
Modifier
<exclusions>
<module name="org.apache.logging.log4j.api">
</module></exclusions>
This allows us to exclude the Log4j 2 API temporarily to bypass the conflict. After the upgrade, we could remove the exclusion to restore full logging functionality.
Would this approach be safe, or could it cause instability or log loss during the upgrade process?

Option 2 – Upgrade in Two Steps (via 8.3.2)
Would it be possible to first upgrade to an intermediate version like EJBCA 8.3.2, and then proceed to 9.0.0?
If so, does this path avoid the Log4j issue, and is it a supported upgrade method?

Option 3 – Wait for a Future Release
We noticed that EJBCA Community 9.1.1 has been released recently.
Do you know if this version addresses the Log4j conflict? If not, will an upcoming release (e.g., 9.2 or 9.3) include a permanent fix?

Thanks again for your time and help. Looking forward to your feedback so we can move forward safely with the upgrade.

Best regards,
Omar Salek

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)

Tomas Gustavsson — Fri, 04 Apr 2025 18:39:23 -0000

You can find information about this at GitHub there the forum is now located. You can find a link to GitHub Discussions on the web page. https://www.ejbca.org/engage/

Recent posts to Discussion

Basic authentication after client certificate failure when attempting to access the EJBCA administrator interface.

Basic authentication after client certificate failure when attempting to access the EJBCA administrator interface.

Error revoking certificate by EJBCA REST

Error revoking certificate by EJBCA REST

How can I change the Management CA Certificate Profile

EJBCA-CE Docker - API enabled but not working

Client certificate or OAuth bearer token required

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)

Urgent: Compatibility Issue During EJBCA Upgrade (Log4j Conflict)