No CertificateData found with fingerprint xxx on VA

[maxwellchandler]

My VA server has the CertificateData table constantly synced with my CA. I have imported all the active CA certs on my CA into my VA as external CAs.

Yet in the server.log i constantly see: No CertificateData found with fingerprint 049a1b0baf74aea8a811f24c8d72dba59a4e029b for 'CN=SUBCAOCSP' issued by 'CN=SUBCA'.

Yet if i Query the ejbca.CertificateData table on my VA:

MariaDB [ejbca]> select fingerprint from CertificateData;
+------------------------------------------+
| fingerprint |
+------------------------------------------+
| 049a1b0baf74aea8a811f24c8d72dba59a4e029b |

+------------------------------------------+
9 rows in set (0.000 sec)

The fingerprint IS there. All of the certs exist in the database. This makes it so that when i make an ocsp request i get :

Unable to build certificate chain for OCSP signing certificate with Subject DN 'CN=Responder'. CA with Subject DN 'CN=SUBCAOCSP' is missing in the database.

However it DOES exist in the database. Im confused.

I tried refreshing the cache through the cli, and rebuilding the jar. Is there something I'm missing here? Even the ManagementCA has this status (no certificate data found), but I have admin privileges and can use the admin portal.....

[primetomas]

So what it does internally is:

1. from leaf certificate, get issuerDN and issuerFingerprint (these are columns in the database that must exist).
2. find certificates with subjectDN == issuerDN above.
3. get the authorityKeyID from the leafCertificate (by certificate extension), match this with subjectKeyID (by certificate extension of all the certificate find in step 2
4. if there is a match, we found the issuer certificate
5. do the same with the found issuer as leaf certificate until you end up with a self signed certificate

So you need to have the subjectDN, issuerDN and issuerFingerprint columns all set correctly, the certificates in the chain must have subject/authorityKeyIDs, and the correct certificates with matching auth/subjectKeyIDs must be there.

[maxwellchandler]

@primetomas Thanks for the answer!

Regarding point 1:

I don't see the column issuerFingerprint anywhere in the CertificateData table or the ejbca database. These are the columns I see:

Is it possible that column has been renamed to cAfingerprint or just fingerprint? I am using the latest version of ejbca ce.

Regarding point 3:

Is this an operation that happens in the database or is the ejbca VA pulling these keys from the certificates themselves? Isee the subjectKeyID column but not the authorityKeyID column.

Thanks!

[primetomas]

sorry, it's called caFingerprint and has always been. My typo, it's named issuerFingerprint in some places in the java code, but the column is caFingerprint.

[primetomas]

subjectKeyID and authorityKeyId are fields inside the certificate. These are pretty much a must in certificates and are enabled by default in certificate profiles.

[maxwellchandler]

@primetomas

Thank you!

It appears that when I sync the entire ejbca database between the CA and VA and not just the CertificateData table, the error about "no certificate data found" goes away.

Do you know what the essential tables are that the VA must have synced with the CA? I dont want to sync the entire database, just the tables that are necessary.

Thanks,

Max

[primetomas]

Great question. We have some documentation here:
https://doc.primekey.com/ejbca/troubleshooting-guide/validation-authority
It only mentions CertificateData and CRLData.

But since that was written a few (perhaps relevant) tables have been added. Like Base64CertData, NoConflictCertificateData, OcspResponseData.

Try with these and let me know if I should update the documentation.