Importcertsms - Certificates not imported when importing from certdump.txt

[alexgoben]

Hey folks, I'm ditching my Windows CA and transitioning over to EJBCA CE.

I'm already moved the CA keys and certificate over to the EJBCA host, but when attempting to import the cert DB from the certdump.txt file, the output states no rows were imported. This is just a test install, so there are only two certificates in the certdump.txt file.

This is the documentation I'm following.

Steps to reproduce:

1. Copy certdump.txt to EJBCA host.
2. Copy certdump.txt to docker container (ejbca node) and place it in /opt/keyfactor/bin
3. SSH into ejbca node (docker exec) and cd to /opt/keyfactor/bin
4. Execute ./ejbca.sh ca importcertsms --caname <name of my ca> -f certdump.txt --verbose

The output from the container results in the following:

bash-5.1$ ./ejbca.sh ca importcertsms 'certdump.txt' 'My CA Name' --verbose
2024-08-08 22:02:51,419+0000 ERROR [org.ejbca.ui.cli.infrastructure.parameter.ParameterHandler] (main) SETTING: -f as certdump.txt
2024-08-08 22:02:51,420+0000 ERROR [org.ejbca.ui.cli.infrastructure.parameter.ParameterHandler] (main) SETTING: --caname as My CA Name
2024-08-08 22:02:51,592+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) ------------------------------------------------------------------------------
2024-08-08 22:02:51,592+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                                                                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                             =: S U M M A R Y :=                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                                                                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) -------------------------------------------------------------------------------
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) 
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) No rows were imported.
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) 
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) -------------------------------------------------------------------------------

I've confirmed that the certdump.txt file does indeed contain two certificates, in PEM format. Anyone have any ideas as to what could cause the certificates to be omitted?

[primetomas]

Would you mind sharing what a row looks like?

The command expects lines in certdump.txt file to start with something like "Row " followed by colon, "User Principal Name" : etc. I don't have an example file, but like to confirm that your file looks correct. Unless a line starts with "Row" it will not be read.

[alexgoben]

The certdump.txt file does follow that format, though I wonder if the line breaks could be what's causing the issue?

Schema:
  Column Name                   Localized Name                Type    MaxLength
  ----------------------------  ----------------------------  ------  ---------
  UPN                           User Principal Name           String  2048 -- Indexed
  CertificateTemplate           Certificate Template          String  254 -- Indexed
  Request.Disposition           Request Disposition           Long    4 -- Indexed
  RawCertificate                Binary Certificate            Binary  16384

Row 1:
  User Principal Name: EMPTY
  Certificate Template: "1.3.6.1.4.1.311.21.8.6898209.12030047.543144.8564883.11683603.215.2955341.994675" Internal Web Server
  Request Disposition: 0x14 (20) -- Issued
  Binary Certificate:
  -----BEGIN CERTIFICATE-----
<certificate content>
  -----END CERTIFICATE-----

[primetomas]

I wonder if this is a case of the file not being able to be read due to docker things? You should probably volume mount the certdump file instead of trying to copy it into the container, and run the command with -f and the full path to the filename.

[alexgoben]

I'll give that a shot here shortly and confirm if that is indeed the case.

[alexgoben]

Got pulled away from this project but finally had time to return and keep testing. After a day, I realized the issue...charset.

The default charset of certdump.txt was ascii, and the importcertsms help page actually mentions if charset isn't specified then UTF-16 will apply. As soon as I specified UTF-8, I was back in business.

[primetomas]

That's great. Do you think this could be documented better/clearer somewhere? If so I would be happy to improve say the CLI help text if you have any suggestion.

[alexgoben]

That would definitely be helpful just in case any folks run into this issue later down the road. Two changes I'd suggest to the getCommandDescription value:

1. Recommend to the user to also add the certutil schema columns SerialNumber and DistinguishedName. Both can be helpful when needing to set the entity name, particularly DN. That would look like the following here:

certutil -view -restrict \"GeneralFlags > 0\" /out \\" + System.lineSeparator()
                + "        \"UPN,CertificateTemplate,Disposition,RawCertificate,SerialNumber,DistinguishedName\" > certdump.txt"

2. In the command example, include the --charset parameter with a hint. That would look like the following here:

"    ./ejbca.sh ca importcertsms '/path/to/certdump.txt' 'Name of CA' --charset [Optional Parameter - Default: UTF-16 | UTF-8 | etc..] --verbose"

[primetomas]

Thanks a lot for the suggestion. I updated the text in Git for a future release (9.3).