Bulk end entities creation

[surtan02]

I am using the community edition of EJBCA Docker. user/end entity would able to request for their own certificate, but the creation of end entity is managed by the admin(superadmin). I can achieve it by creating an end entity and make the user request for their own certificate.

The problem is there are too many end entities and creating it one by one via the admin web gui is taking too much time and effort. Is there any way for me to bulk create the end entities? and maybe 'force' user to change their password/enrollment when they try to issue a certificate so they wont keep the 'default' pass set by the admin.

[svenska-primekey]

You can use the EJBCA CLI to bulk add users to EJBCA. There is no ability to force a password change. You could configure email and have the password auto generated and then email that to the user upon adding the user to EJBCA.

[primetomas]

Note that the "password" is really a one time enrollment code. So nothing that need changing.

[surtan02]

Isnt the password also used as the password for the generated PKCS12 file?

[svenska-primekey]

Correct the password is used to protect the P12 or JKS file.

[surtan02]

I am not sure if this is supposed to be a new issue or not, but if I want to open RA for public access and enable end entities to edit their data (enrollment code, CN, etc.),. How do you make sure endentities edit their own? because now anyone can edit others data. (I hope I don't need a client certificate.)

[primetomas]

End entities can not edit end entity data.
https://doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/ra-operations-guide/configure-ejbca-for-public-access

You can enable unauthenticated end entities to make request, which requires approval. The end entity makes a request with their desired data, and an admin approves (or denies) it. The admin can also modify the data.
https://doc.primekey.com/ejbca/ejbca-operations/ejbca-operations-guide/ra-operations-guide/managing-requests-in-the-ra-ui