Configure EJBCA behind Nginx Proxy Manager

[BHuck74]

Dear all,

I'm exhausted trying for hours to get EJBCA working behind Nginx Proxy Manager. I've deployed EJBCA using Docker without issue using the following docker-compose:

version: '3'
services:
  ejbca-database:
    container_name: ejbca-database
    image: library/mariadb:lts
    networks:
      - application-bridge
    environment:
      - MYSQL_ROOT_PASSWORD=foo123
      - MYSQL_DATABASE=ejbca
      - MYSQL_USER=ejbca
      - MYSQL_PASSWORD=ejbca
    volumes:
      - ejbca-data:/var/lib/mysql:rw
  ejbca-node1:
    hostname: ejbca-node1
    container_name: ejbca
    image: keyfactor/ejbca-ce:latest
    depends_on:
      - ejbca-database
    networks:
      - proxy_network
      - application-bridge
    environment:
      - DATABASE_JDBC_URL=jdbc:mariadb://ejbca-database:3306/ejbca?characterEncoding=UTF-8
      - LOG_LEVEL_APP=INFO
      - LOG_LEVEL_SERVER=INFO
      - TLS_SETUP_ENABLED=true

volumes:
  ejbca-data:

networks:
  proxy_network:
    external: true # proxy_network need to be created beforehand in Portainer interface
  application-bridge:
    driver: bridge

Enrollment is working like a charm and I was able to import the certificate into the browser.

That said, trying the access the https://myserver/ejbca/adminweb/ url is leading to an authorization denied error:

Authorization Denied
No client certificate was presented

If you did not get prompted to select a client certificate, please check that you have the correct certificate.

I guess this is probably due to NPM configuration, but no idea how I could tackle this issue...

I've found the following link but brought more confusion than other.
https://sourceforge.net/p/ejbca/discussion/123123/thread/d7b4c6b884/

In particular I don't understand what about ports 8081 / 8082 that are referenced in the configuration...

I'm close to give up... Any clues about how I could get it working behind RP?

Cheers

[HarimbolaSantatra]

The documentation recommended to use TLS_SETUP_ENABLED=later for usage with a reverse proxy. But in that case, the admin UI and RA will work fine but the API will still require a client certificate.
I also encounter a similar issue here: #614

[BHuck74]

Thank you for your answer.

If I'm not mistaken, using TLS_SETUP_ENABLED=later will allow access without authentication which is basically not great...
I've unfortunately no time to dig deeper into that issue for the moment, and documentation isn't helping neither clear at all.

Cheers

[HarimbolaSantatra]

You should use the PROXY_HTTP_BIND environment variable, as this will enable the container to use a client certificate provided on the SSL_CLIENT_CERT HTTP header. I managed to make it work by using this nginx configuration

[BHuck74]

Mmm, thanks for the tip, I will give it a try, even if I don't need to be able to use the API (at least for the moment). My interest is more in being able to sign certificates using the GUI, which is basically much more user friendly that any other CLI approach...

[primetomas]

We have some new container documentation, including Helm charts to deploy EJBCA to kubenteres, with optional ingress.
Take a look: https://docs.keyfactor.com/container/latest/ejbca/deployment