Ejbca No clear text password for user

[Ayhalab]

Hello everyone,

For a project, we're using EJBCA. When we add an entity with a username and password, and later this entity sends a CMP request to authenticate and obtain a certificate, I encounter the error: "No clear text password for user, not possible to check authentication." Additionally, when I run the find endentity command, the password field is displayed as hidden.

Do you have any idea what might be causing this issue?
Note that right after adding the entity, the password is visible, but after a while, it changes to hidden.

thank you!

[primetomas]

When you add an end entity in the UI there is a checkbutton "Batch generation (clear text pwd storage)". You need to check this when adding the end entity for this use case.

[Ayhalab]

thank you for your response,

I believe this option was enabled at the time I added the end entities. Here is the command I use:
for name in "$@"; do ejbca.sh ra addendentity $name --password [PASSWORD] "CN=$name,OU=**,O=**,C=**" AC_RSA 1 USERGENERATED --eeprofile DEVICE_RSA --certprofile DEVICE_ENDUSER_RSA ejbca.sh ra setclearpwd $name [PASSWORD] done
Is it possible to fix the issue without having to re-add the end entities? For security reasons, we no longer have access to the end entity passwords, as they are hardcoded during manufacturing and cannot be reprovisioned.

thank you,

[primetomas]

The password you set is a one-time enrollment code. It can only be used once (for each end entity). If you need to renew a certificate the recommended way is to use CMP renewal (since you use CMP).
There is a feature in the end entity profile to enable multi-use of enrollment codes, for enrolling say an authentication and an encryption certificate for the same end entity. But I don't know your work-flow so it's hard to give advice.

The password is cleared when the end entity uses the password, so when you say "the password is visible, but after a while, it changes to hidden" that means that the password was used to enroll for a certificate.