Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-9301

EJBCA freezes at startup if cyclic cross-signed root certificates are used in OCSP chain

    Details

    • Issue discovered during:
      Customer

      Description

      If two root CAs are cross-signed by each other, there will be a cycle in the certification trust path.

      If a such cycle exist, and one of the roots are used in the certificate chain for OCSP, then EJBCA goes into an endless loop trying to add the the roots to the chain. This results in the following messages with alternating DNs, if debug logging is turned on, and eventually EJBCA runs out of heap space.

      xx:xx:xx,124 DEBUG [org.cesecore.certificates.certificate.CertificateStoreSessionBean] (ServerService Thread Pool -- xx) Looking for cert with (transformed) DN: CN=xxxxxx
      xx:xx:xx,128 DEBUG [org.cesecore.certificates.certificate.CertificateStoreSessionBean] (ServerService Thread Pool -- xx) Looking for cert with (transformed) DN: CN=yyyyy
      xx:xx:xx,133 DEBUG [org.cesecore.certificates.certificate.CertificateStoreSessionBean] (ServerService Thread Pool -- xx) Looking for cert with (transformed) DN: CN=xxxxxx
      xx:xx:xx,137 DEBUG [org.cesecore.certificates.certificate.CertificateStoreSessionBean] (ServerService Thread Pool -- xx) Looking for cert with (transformed) DN: CN=yyyyy
      

      The problem happens when the OCSP chache is built, which happens at startup. So it prevents EJBCA from starting.

      Note that the only the most recent, non-expired certificates are used.

      We have a patch that should solve OCSP responder startup, so it gets to the point where it can responds to OCSP queries. But there may be other parts of EJBCA that are affected. This should be checked also (does not need to go to the same release, so it could be done as separate issues, if it turns out to be time consuming)

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              hsunmark Henrik Sunmark
              Reporter:
              samuel Samuel Lidén Borell
              Verified by:
              Jekaterina Bunina
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 3 days
                  3d
                  Remaining:
                  Time Spent - 4 hours Remaining Estimate - 2 days, 4 hours
                  2d 4h
                  Logged:
                  Time Spent - 4 hours Remaining Estimate - 2 days, 4 hours
                  4h