Can't retrieve certificate through RA UI using username and enroll passcode

Question

I have EJBCA deployed in my home lab to replace XCA. I've created a ClientAuth certificate using a new root certificate I created myself. And another ClientAuth certificate using the ManagementCA root certificate. As the Public Access User, without authenticating. Neither of them can be retrieved from RA UI (aka /ejbca/ra) using a username. But work's fine if I try to retrieve them from the Public Access Web (/ejbca/enrol/keystore.jsp). The issue here is, the Public Access Web is going to be removed in the next version, and users are required to move over to RA UI workflows. Hence why I am trying to get this to work. Does anyone know what am I doing wrong here? Is this a permission issue? A broken docker installation?

The logs aren't clear where the issue lies, so it's difficult to acertain what is the problem. Insofar, I have tried setting various permissions on the assumption that Public Access user may not have access to end entities.

Answer 1

As a Public Access User in the RA UI there will be improvements in the coming release so it will be certain to work. There was some permissions issues (not sure myself what they are), but it's improved for the next release, and will be documented.

Answer 2

Public access user simply needed access to the CA that holds the end identity in question. In this case, an Access Rule for the Public Access User in Roles and Access Rules needs to be granted to the/ca/IssuingCA/. To retrieve and/or view the end identity issues by that CA.

Answer 3

EJBCA 8.0 was just released with more functionality for completely replacing the old public web with the RA web, including using username/enrollment code for unauthenticated users.