EJBCA Container installation doesnt work

[johnlanham1957]

I am following the tutorial from the Keyfactor site to get EJBCA installed in Docker from this link:

https://docs.keyfactor.com/ejbca/latest/tutorial-start-out-with-ejbca-docker-container

However, the process is either missing steps or Maria DB has made some changes, when you get to step 3 'Start EJBCA Community container' and you run the command to view the logs, EJBCA is not able to connect to the MariaDB host and errors with:

Socket fail to connect to host:address=(host=ejbca-database)(port=3306)(type=primary). ejbca-database

Waiting for external database 'jdbc:mariadb://ejbca-database:3306/ejbca?characterEncoding=UTF-8' to become available.

The MariaDB container reports

Aborted connection 1 to db: 'unconnected' user: 'unauthenticated' host: '172.18.0.3' (This connection closed normally without authentication)

Has anyone else encountered this??

[primetomas]

Hmm, it looks suspicious that there are no variable for the ejbca-node1 environment with DATABASE_USER and DATABASE_PASSWORD. There should probably be those added under DATABASE_JDBC_URL. Or since it contains secrets it is probably expected to be inserted by a secrets manager to avoid having that password in the code. I.e. in production database password should NOT be in the yaml file.
But you can try to add those there and see if that works. If it is that, I'll ask them to update the tutorial with those details.

[johnlanham1957]

Thanks @primetomas I switched to this approach given my failed upgrade, only to run into this issue :-(

I have a 100% clean Almalinux 8.10 installation where nothing has been installed previously and I am following these steps to the letter, no deviation in terms of passwords or anything else, the EJBCA host never connects to the DB server :-(

[primetomas]

What I write above means that you have to modify the docker-compose file and test again.

[johnlanham1957]

@primetomas Thanks, but that makes no difference, a friend of mine followed the same steps using Docker on Windows and the steps in your tutorial work fine, this seems to be related to Docker on Linux??

[Jeff-Lawson]

Similar for me. I followed the tutorial to the letter and everything worked fine. Then I shutdown Ubuntu, started it up the following day, ran:

   sudo docker compose up -d
   sudo docker compose logs -f

and saw the following repeating over and over...

ejbca           | 2024-12-05 17:09:37,620+0000 INFO  [org.apache.commons.beanutils.FluentPropertyBeanIntrospector] (main) Error when creating PropertyDescriptor for public final void org.apache.commons.configuration2.AbstractConfiguration.setProperty(java.lang.String,java.lang.Object)! Ignoring this property.
ejbca           | 2024-12-05 17:09:37,712+0000 ERROR [org.ejbca.ui.cli.jdbc.JdbcTool] (main) Socket fail to connect to host:address=(host=ejbca-database)(port=3306)(type=primary). No route to host (Host unreachable)
ejbca           | 2024-12-05 17:09:37,712+0000 INFO  [org.ejbca.ui.cli.jdbc.JdbcTool] (main) Done.
ejbca           | 2024-12-05 17:09:37,733+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Waiting for external database 'jdbc:mariadb://ejbca-database:3306/ejbca?characterEncoding=UTF-8' to become available.

@primetomas, you mentioned editing the docker-compose.yml file but I would not know what to change:

networks:
  access-bridge:
    driver: bridge
  application-bridge:
    driver: bridge
services:
  ejbca-database:
    container_name: ejbca-database
    image: "library/mariadb:latest"
    networks:
      - application-bridge
    environment:
      - MYSQL_ROOT_PASSWORD=foo123
      - MYSQL_DATABASE=ejbca
      - MYSQL_USER=ejbca
      - MYSQL_PASSWORD=ejbca
    volumes:
      - ./datadbdir:/var/lib/mysql:rw
  ejbca-node1:
    hostname: ejbca-node1
    container_name: ejbca
    image: keyfactor/ejbca-ce:latest
    depends_on:
      - ejbca-database
    networks:
      - access-bridge
      - application-bridge
    environment:
      - DATABASE_JDBC_URL=jdbc:mariadb://ejbca-database:3306/ejbca?characterEncoding=UTF-8
      - LOG_LEVEL_APP=INFO
      - LOG_LEVEL_SERVER=INFO
      - TLS_SETUP_ENABLED=simple
    ports:
      - "80:8080"
      - "443:8443"

Help would be greatly appreciated :-)

[Jeff-Lawson]

Hi,
Problem solved. I was stupid in following the last step of the tutorial be entering:

docker compose down

So, I reinstalled everything, neglected to enter the last command and I can now reboot, logon and enter:

docker compose up -d
docker compose logs -f

and all is good :-)
(I am sure there is a way to recover from following the last step of the tutorial but I do not know enough to do that.)