CLI could not contact EJBCA instance

[merryo11]

Hi Folks, I am doing ejbca installation without docker on ubuntu 24.04 LTS. I setup DB as mysql and application server as JBoss EAP 8.0 with EJBCA 9 (source code downloaded from github).

I followed below link (https://docs.keyfactor.com/ejbca/9.0/ejbca-installation) as it is except that I did not configure eleytron on application server and skipped the optional configuration.

uptill ant -q clean deployear things are fine and my ejbca.ear got created and deployed on jboss and tables on mysql db but when i run ant command "ant runinstall" i am getting below error:

ERROR org.ejbca.ui.cli.infrastructure.library.CommandLibrary - Error: CLI could not contact EJBCA instance. Either your application server is not up and running, EJBCA has not been deployed successfully, or some firewall rule is blocking the CLI from the application server.

I am not getting where i am going wrong. Seems like some permission issue but there is no details on the link above where it is asking for user creation. My ejbca source folder is with root permission whereas my jboss setup folder is with jboss user.

Appreciate if I can get the response at the earliest.

[merryo11]

Any help from the community

[primetomas]

Nothing in the server.log?

[merryo11]

Yes that is what confusing me. There is nothing in log and still I am getting this error. Though my build gets successful. I tried with EJBCA CE 9 j boss 8 but stuck with same error. Is there any windows stepwise guide for people who does like linux

…

On Mon, Jan 13, 2025, 9:27 PM Tomas Gustavsson ***@***.***> wrote: Nothing in the server.log? — Reply to this email directly, view it on GitHub <#765 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BCLN37AZOJZ6R46QUFOWNED2KPSQ7AVCNFSM6AAAAABUXXTBCOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCOBSGIYDKNY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[PhilLaCiotat]

Hello,
I'm facing the same pb, but after migration from E8 to E9 (wfl24 => wlf32).
CLI was working under E8 and now the message is : CLI could not contact EJBCA instance. Either your application server is not up
But with a large stackTrace saying :
Exception in thread "main" jakarta.ejb.NoSuchEJBException: EJBCLIENT000079: Unable to discover destination for request for EJB StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None
...
at org.ejbca.ui.cli.EjbcaEjbCli.main(EjbcaEjbCli.java:38)
Suppressed: javax.security.sasl.SaslException: Authentication failed: none of the mechanisms presented by the server (ANONYMOUS) are supported
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:443)
...

Unfortunately I didn't find any info/doc about how to configure mTLS for CLI ...

Any help appreciated...

[primetomas]

It's not mTLS for CLI. This should be related to remoting.
https://docs.keyfactor.com/ejbca/latest/wildfly-32#id-(9.1.1)WildFly32-ConfigureWildFlyRemoting

The CLI work for me on WF 33 with the above remoting configuration.

[PhilLaCiotat]

Thanks Tomas for your feedback,

ButI already have this configuration which is working fine with ejbca8
Now after migration to ejbca9 same configiration does not work anymore complaining about "SaslException: Authentication failed"
Joined my standalone.xml file...

standalone-ha.xml.zip

[PhilLaCiotat]

SOLVED
Solution : need now to have sasl declaration in http-remoting (remoting subsystem) :

[primetomas]

Great. Is there anything that should be changed/added to the installation instructions?