In this tutorial, you will learn how to create and configure an ephemeral certificate authority (CA) to issue ephemeral certificates, use OCSP to validate the certificate, revoke the certificate using the REST API, and validate that the certificate is revoked.
📚 *The tutorial covers these steps:*
0:41 Start the Docker containers
1:57 Create a crypto token for the ephemeral CA
3:08 Create and configure certificate profiles
4:38 Create the ephemeral CA
5:46 Create an end entity profile for the ephemeral device
6:49 Issue an ephemeral certificate using the REST API
7:53 Validate the certificate using OCSP
8:51 Revoke the ephemeral certificate using the REST API
8:59 Validate the revoked certificate using OCSP
💡 *Prerequisites*
Before you begin, you need:
- A running EJBCA instance with a Root CA, certificate profiles, end entity profiles, roles, and short-lived ephemeral certificates configured in EJBCA, see this playlist: czcams.com/play/PLt17f5skfOPEcg-Hbn4d-YY22wdmnaEa9.html.
- To be familiar with CLI and OpenSSL tools
- SSH access to the Linux host where the EJBCA container is running
*Download*
- EJBCA on Docker Hub: hub.docker.com/r/keyfactor/ejbca-ce
- EJBCA on GitHub: github.com/Keyfactor/ejbca-ce
*Documentation*
- Full tutorial:
docs.keyfactor.com/ejbca/latest/tutorial-use-an-ephemeral-CA-and-revoke-ephemeral-
ℹ️ *About the Keyfactor Community*
As a pioneer in open-source cryptography, PKI, and signing, Keyfactor offers Bouncy Castle cryptographic APIs, the open-source certificate authority software EJBCA Community, and the open-source signing software SignServer Community. Join the Keyfactor Community, a hub for engineers, developers, and security experts seeking relevant solutions for cryptography, certificates, PKI, and signing while prototyping or testing their products and applications. The Keyfactor Community is a part of Keyfactor. Read more on www.keyfactor.com/open-source/community/.
🔗 *For more information:*
- Visit the website: www.ejbca.org/
- Get started with EJBCA: www.ejbca.org/use-cases/get-started-with-ejbca-pki/
- Sign up for our newsletter: www.ejbca.org/#popup-newsletter
- Follow us on X (Twitter): KeyfactorComm