Soft Crypto Token storage customization for OCI Vault

[tedrextr]

Hi all experts,
I am looking for a least cost way of integrating EjbCA with Oracle cloud (akai OCI).
By default, the soft crypto token key materials are stored in CryptoTokenData table when mysql db is used.
My goal is to move them into a more secure storage, specially OCI Vault:
https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm
After some research, it seems like like I need to implement com.keyfactor.util.keys.token.BaseCryptoToken
At least, Azure integration seem to be done that way.
Then how do I integrate it back to EbjCA itself?
Thank you for any help and reference

[primetomas]

You would need to implement a new Crypto Token, basically replicating the Azure Key Vault crypto token. After doing that including any test cases (like Azure Key Vault), you would create a pull request for EJBCA for us to look at it.

[tedrextr]

Thanks Thomas, I will try as you said.

[tedrextr]

Tomas, do you have any instructions on how to setup eclipse+widlfly+ejbca_latest dev env?
Having worked on intellij and maven lately, I could appreciate that.

[tedrextr]

Is https://doc.primekey.com/ejbca site working?

[primetomas]

Not yet. Many developers use IntelliJ, so if you are to that you can stick with that.

[tedrextr]

Do you know what is the corresponding github commit for these docker images in https://hub.docker.com/r/keyfactor/ejbca-ce ?
I have pulled the latest source version from https://github.com/Keyfactor/ejbca-ce, but it does not match the latest docker image.
Is there any special file that can serve as a clue for matching github commit?

[primetomas]

This file would be the version commit.
https://github.com/Keyfactor/ejbca-ce/blob/main/src/internal.properties
There is no guarantee that the container matches the source version, they are updated independently of each other and may differ in exact code. But the differences should be small enough so it doesn't matter.

[tedrextr]

Hi Thomas, Is there any plan/advancement in making EjbCA compliant with newer versions of WildFly, like at least v28 ? When trying to integrate EjbCA with OCI JDK in WildFly env, we are getting conflict between Jersey JAX-RS that is used by OCI and RestEasy JAX-RS built into WildFly 26 WildFly 26 seems to be the latest version that is known to be compatible with EjbCA. With WildFly 28 we don't experience the above issue. Thanks Ted

…

On Thu, 30 Nov 2023 at 05:10, Tomas Gustavsson ***@***.***> wrote: This file would be the version commit. https://github.com/Keyfactor/ejbca-ce/blob/main/src/internal.properties There is no guarantee that the container matches the source version, they are updated independently of each other and may differ in exact code. But the differences should be small enough so it doesn't matter. — Reply to this email directly, view it on GitHub <#396 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5SBTWCSCDZTM2PF7G7BY73YHBLSFAVCNFSM6AAAAAA6YJ4HLKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TOMJVGY3TC> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[primetomas]

See #569

[tedrextr]

thanks for info and quick response!

…

On Mon, 6 May 2024 at 12:44, Tomas Gustavsson ***@***.***> wrote: See #569 <#569> — Reply to this email directly, view it on GitHub <#396 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5SBTWHO7LAFQLYMS4PDSFTZA6XQRAVCNFSM6AAAAAA6YJ4HLKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TGMZRHAYTS> . You are receiving this because you authored the thread.Message ID: ***@***.***>