Subject: Issue Accessing EJBCA and SignServer Web Interface on EC2

[Babacar98]

Hello,

I have deployed EJBCA and SignServer using Docker containers and Helm charts. However, I am facing an issue: even though I am using the URL provided in the deployment output along with the public IP of my EC2 instance, I am unable to access the web interface.

Do you have any suggestions or solutions to resolve this access issue?

Thank you in advance for your help!

[primetomas]

It looks like it's listening. What error do you get in the browser? Are you sure the routing is as it should?

[Babacar98]

@primetomas Hello,

Thank you for your feedback.

The output does not indicate any errors, and all my services are running normally. I believe I should modify the values.yml file to specify host: . What do you think?

Do you have any other suggestions or advice regarding this modification?

Thank you in advance for your help!

[Babacar98]

@primetomas I am currently stuck in SignServer as I need the TLS ManagementCA certificate to proceed.

[Babacar98]

I have 404 page not found on my navigator

[primetomas]

What URL do you use, and is that IP:port actually exposed to the host where you run the browser? That's the most common issue.

[Babacar98]

@primetomas hello M.Gustavsson

root@worker01ejbca:/home/ubuntu# kubectl get services -n ejbca
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
database-svc ClusterIP 10.103.38.174 3306/TCP 24h
ejbca-lb-svc NodePort 10.100.201.6 443:32713/TCP,80:32513/TCP 24h
root@worker01ejbca:/home/ubuntu# kubectl get pods -n ejbca
NAME READY STATUS RESTARTS AGE
database-deployment-54dd986647-4p8rd 1/1 Running 3 (18h ago) 24h
ejbca-ejbca-ce-7bc6897546-49586 2/2 Running 6 (35m ago) 24h
root@worker01ejbca:/home/ubuntu# kubectl logs ejbca-ejbca-ce-7bc6897546-49586 -n ejbca
Defaulted container "httpd" out of: httpd, ejbca-ce, ejbca-ce-init (init), ca-cert-locator (init)
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.244.0.19. Set the 'ServerName' directive globally to suppress this message
[Thu Dec 05 10:38:34.150993 2024] [ssl:info] [pid 1:tid 1] AH01883: Init: Initialized OpenSSL library
[Thu Dec 05 10:38:34.162097 2024] [ssl:info] [pid 1:tid 1] AH01887: Init: Initializing (virtual) servers for SSL
[Thu Dec 05 10:38:34.162111 2024] [ssl:info] [pid 1:tid 1] AH01914: Configuring server 10.244.0.19:8443 for SSL protocol
[Thu Dec 05 10:38:34.171118 2024] [ssl:warn] [pid 1:tid 1] AH01909: 10.244.0.19:8443:0 server certificate does NOT include an ID which matches the server name
[Thu Dec 05 10:38:34.171129 2024] [ssl:info] [pid 1:tid 1] AH02568: Certificate and private key 10.244.0.19:8443:0 configured from /usr/local/certs/cert.pem and /usr/local/certs/key.pem
[Thu Dec 05 10:38:34.171391 2024] [ssl:info] [pid 1:tid 1] AH01914: Configuring server 10.244.0.19:8444 for SSL protocol
[Thu Dec 05 10:38:34.172196 2024] [ssl:warn] [pid 1:tid 1] AH01909: 10.244.0.19:8444:0 server certificate does NOT include an ID which matches the server name
[Thu Dec 05 10:38:34.172200 2024] [ssl:info] [pid 1:tid 1] AH02568: Certificate and private key 10.244.0.19:8444:0 configured from /usr/local/certs/cert.pem and /usr/local/certs/key.pem
[Thu Dec 05 10:38:34.172450 2024] [ssl:info] [pid 1:tid 1] AH01876: mod_ssl/2.4.62 compiled against Server: Apache/2.4.62, Library: OpenSSL/3.0.15
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 10.244.0.19. Set the 'ServerName' directive globally to suppress this message
[Thu Dec 05 10:38:34.175409 2024] [ssl:info] [pid 1:tid 1] AH01883: Init: Initialized OpenSSL library
[Thu Dec 05 10:38:34.175445 2024] [ssl:warn] [pid 1:tid 1] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Thu Dec 05 10:38:34.175465 2024] [ssl:info] [pid 1:tid 1] AH01887: Init: Initializing (virtual) servers for SSL
[Thu Dec 05 10:38:34.175476 2024] [ssl:info] [pid 1:tid 1] AH01914: Configuring server 10.244.0.19:8443 for SSL protocol
[Thu Dec 05 10:38:34.177180 2024] [ssl:warn] [pid 1:tid 1] AH01909: 10.244.0.19:8443:0 server certificate does NOT include an ID which matches the server name
[Thu Dec 05 10:38:34.177217 2024] [ssl:info] [pid 1:tid 1] AH02568: Certificate and private key 10.244.0.19:8443:0 configured from /usr/local/certs/cert.pem and /usr/local/certs/key.pem
[Thu Dec 05 10:38:34.177514 2024] [ssl:info] [pid 1:tid 1] AH01914: Configuring server 10.244.0.19:8444 for SSL protocol
[Thu Dec 05 10:38:34.178879 2024] [ssl:warn] [pid 1:tid 1] AH01909: 10.244.0.19:8444:0 server certificate does NOT include an ID which matches the server name
[Thu Dec 05 10:38:34.178918 2024] [ssl:info] [pid 1:tid 1] AH02568: Certificate and private key 10.244.0.19:8444:0 configured from /usr/local/certs/cert.pem and /usr/local/certs/key.pem
[Thu Dec 05 10:38:34.179216 2024] [ssl:info] [pid 1:tid 1] AH01876: mod_ssl/2.4.62 compiled against Server: Apache/2.4.62, Library: OpenSSL/3.0.15
[Thu Dec 05 10:38:34.180207 2024] [mpm_event:notice] [pid 1:tid 1] AH00489: Apache/2.4.62 (Unix) OpenSSL/3.0.15 configured -- resuming normal operations
[Thu Dec 05 10:38:34.180977 2024] [mpm_event:info] [pid 1:tid 1] AH00490: Server built: Dec 3 2024 02:14:47
[Thu Dec 05 10:38:34.181074 2024] [core:notice] [pid 1:tid 1] AH00094: Command line: 'httpd -D FOREGROUND'
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:19 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 500 69
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:21 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 500 69
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:23 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 500 69
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:25 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 500 69
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:27 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 500 69
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:29 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:38 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:48 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:39:58 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:40:08 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:40:18 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5
10.244.0.1 10.244.0.19:8080 - - [05/Dec/2024:10:40:28 +0000] "GET /ejbca/publicweb/healthcheck/ejbcahealth HTTP/1.1" 200 5

[primetomas]

What helm chart are yo using?
It looks like:

• you are either using the wrong URL to access EJBCA, hence a 404
• the front-end proxy server you are using is not configured correctly to access the back-end EJBCA