Importcertsms - Certificates not imported when importing from certdump.txt

[threeputting]

Hey folks, I'm ditching my Windows CA and transitioning over to EJBCA CE.

I'm already moved the CA keys and certificate over to the EJBCA host, but when attempting to import the cert DB from the certdump.txt file, the output states no rows were imported. This is just a test install, so there are only two certificates in the certdump.txt file.

This is the documentation I'm following.

Steps to reproduce:

1. Copy certdump.txt to EJBCA host.
2. Copy certdump.txt to docker container (ejbca node) and place it in /opt/keyfactor/bin
3. SSH into ejbca node (docker exec) and cd to /opt/keyfactor/bin
4. Execute ./ejbca.sh ca importcertsms --caname <name of my ca> -f certdump.txt --verbose

The output from the container results in the following:

bash-5.1$ ./ejbca.sh ca importcertsms 'certdump.txt' 'My CA Name' --verbose
2024-08-08 22:02:51,419+0000 ERROR [org.ejbca.ui.cli.infrastructure.parameter.ParameterHandler] (main) SETTING: -f as certdump.txt
2024-08-08 22:02:51,420+0000 ERROR [org.ejbca.ui.cli.infrastructure.parameter.ParameterHandler] (main) SETTING: --caname as My CA Name
2024-08-08 22:02:51,592+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) ------------------------------------------------------------------------------
2024-08-08 22:02:51,592+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                                                                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                             =: S U M M A R Y :=                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) |                                                                             |
2024-08-08 22:02:51,594+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) -------------------------------------------------------------------------------
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) 
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) No rows were imported.
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) 
2024-08-08 22:02:51,595+0000 INFO  [org.ejbca.ui.cli.ca.CaImportMsCaCertificates] (main) -------------------------------------------------------------------------------

I've confirmed that the certdump.txt file does indeed contain two certificates, in PEM format. Anyone have any ideas as to what could cause the certificates to be omitted?

[primetomas]

Would you mind sharing what a row looks like?

The command expects lines in certdump.txt file to start with something like "Row " followed by colon, "User Principal Name" : etc. I don't have an example file, but like to confirm that your file looks correct. Unless a line starts with "Row" it will not be read.

[threeputting]

The certdump.txt file does follow that format, though I wonder if the line breaks could be what's causing the issue?

Schema:
  Column Name                   Localized Name                Type    MaxLength
  ----------------------------  ----------------------------  ------  ---------
  UPN                           User Principal Name           String  2048 -- Indexed
  CertificateTemplate           Certificate Template          String  254 -- Indexed
  Request.Disposition           Request Disposition           Long    4 -- Indexed
  RawCertificate                Binary Certificate            Binary  16384

Row 1:
  User Principal Name: EMPTY
  Certificate Template: "1.3.6.1.4.1.311.21.8.6898209.12030047.543144.8564883.11683603.215.2955341.994675" Internal Web Server
  Request Disposition: 0x14 (20) -- Issued
  Binary Certificate:
  -----BEGIN CERTIFICATE-----
<certificate content>
  -----END CERTIFICATE-----

[primetomas]

I wonder if this is a case of the file not being able to be read due to docker things? You should probably volume mount the certdump file instead of trying to copy it into the container, and run the command with -f and the full path to the filename.

[threeputting]

I'll give that a shot here shortly and confirm if that is indeed the case.