4.5 Configure Operator CA
The Operator CA details identify the CA authority used by OCLM. Configure these details in:
/opt/oclm-service/issuerConfig.propertiesThis file contains the Operator CA CMP server details, CA certificate references, TLS trust configuration, recipient DN, issuer DN, and timeout settings.
Use the provided configuration script to update issuerConfig.properties. The script prompts for each CMP property, shows a short definition and sample value, reuses existing values as defaults, and updates the file in place after confirmation.
Run the following script on the OCLM node:
cd /opt/oclm-service
python3 configureIssuer.pyThe following table provides required properties:
Table 4-2 Required Properties
| Property | Description | Sample Value |
|---|---|---|
| cmp.recipientDN | Recipient Distinguished Name expected by Operator CA for CMP messages. | /C=SE/O=EJBCA Sample/CN=ManagementCA |
| cmp.rootCACerts | Comma separated list of local CA certificate files used to verify certificates issued by Operator CA. At least the Operator CA root certificate is required. | /opt/oclm-service/operator-ca-root.pem |
| cmp.server | Operator CA CMP endpoint URL. Include scheme, host, port, and any required CMP alias/path. Mask IP addresses in shared documentation. | http://10.xxx.xxx.xxx:8080/ejbca/publicweb/cmp/oclm |
Table 4-3 Optional or Conditional Properties
| Property | Description | Sample Value |
|---|---|---|
| cmp.issuerDN | Issuer Distinguished Name, if required by Operator CA policy. | /C=SE/O=EJBCA Sample/CN=ManagementCA |
| cmp.totalTimeout | Maximum total time, in seconds, allowed for a complete CMP transaction. The value must be a positive integer from 1 through 480. The default is 30 seconds. | 30 |
| cmp.messageTimeout | Maximum time, in seconds, allowed for one CMP message exchange. The value must be a positive integer from 1 through the configured cmp.totalTimeout value and cannot exceed it. The default is 15 seconds.
|
15 |
| cmp.enableTLS | Set to true when the CMP endpoint uses TLS and OCLM must validate the TLS server certificate. Set to false when TLS validation is not required.
|
false |
| cmp.tlsTrustedCerts | Comma separated list of local TLS trust certificate files. Required when cmp.enableTLS=true. Keep this property commented when cmp.enableTLS=false.
|
/opt/oclm-service/operator-ca-tls-root.pem |
configureIssuer.py validates both timeout values before writing the file. Pressing Enter accepts the displayed existing or default value; the script does not write an empty timeout value.
Sample Script Execution Log
The following log shows a sample execution. The CMP endpoint IP address is masked for documentation. Replace all placeholder IP values, Distinguished Names, and file names with customer-specific values during deployment.
python3 configureIssuer.py
Operator CA CMP issuerConfig.properties updater
Target file: /opt/oclm-service/issuerConfig.properties
cmp.server
Definition : Operator CA CMP endpoint used by OCLM to send CMP requests.
Sample : https://operator-ca.example.com:8443/ejbca/publicweb/cmp/oclm
Enter cmp.server [https://operator-ca.example.com:8443/ejbca/publicweb/cmp/oclm]: http://10.xxx.xxx.xxx:8080/ejbca/publicweb/cmp/occmalias
cmp.recipientDN
Definition : Distinguished Name of the CMP recipient expected by Operator CA.
Sample : /C=SE/O=EJBCA Sample/CN=ManagementCA
Enter cmp.recipientDN [/C=SE/O=EJBCA Sample/CN=ManagementCA]: /C=SE/O=EJBCA Sample/CN=ManagementCA
cmp.issuerDN
Definition : Distinguished Name of the issuer expected by Operator CA.
Sample : /C=SE/O=EJBCA Sample/CN=ManagementCA
Enter cmp.issuerDN [/C=SE/O=EJBCA Sample/CN=ManagementCA]: /C=SE/O=EJBCA Sample/CN=ManagementCA
cmp.totalTimeout
Definition : Maximum total time, in seconds, allowed for a complete CMP transaction (range 1-480).
Sample : 30
Note : Default value is 30 seconds.
Enter cmp.totalTimeout [30]: 30
cmp.messageTimeout
Definition : Maximum time, in seconds, allowed for one CMP message exchange (range 1-cmp.totalTimeout).
Sample : 15
Enter cmp.messageTimeout [15]: 15
cmp.rootCACerts
Definition : Comma-separated CA certificate paths used to verify certificates issued by Operator CA.
Sample : /opt/oclm-service/operator-ca-root.pem,/opt/oclm-service/operator-ca-intermediate.pem
Enter cmp.rootCACerts [/opt/oclm-service/operator-ca-root.pem]: /opt/oclm-service/ManagementCA.pem
cmp.enableTLS
Definition : Enables TLS validation for the Operator CA HTTPS endpoint.
Sample : true
Enter cmp.enableTLS (true/false) [true]: false
cmp.enableTLS is false, so cmp.tlsTrustedCerts will be written as a commented property.
Configuration summary for /opt/oclm-service/issuerConfig.properties:
cmp.server=http://10.xxx.xxx.xxx:8080/ejbca/publicweb/cmp/occmalias
cmp.recipientDN=/C=SE/O=EJBCA Sample/CN=ManagementCA
cmp.issuerDN=/C=SE/O=EJBCA Sample/CN=ManagementCA
cmp.totalTimeout=30
cmp.messageTimeout=15
cmp.rootCACerts=/opt/oclm-service/ManagementCA.pem
cmp.enableTLS=false
# cmp.tlsTrustedCerts=/opt/oclm-service/operator-ca-tls-root.pem
Write these changes (y/N): y
Updated: /opt/oclm-service/issuerConfig.propertiesWhen cmp.enableTLS=false, cmp.tlsTrustedCerts may remain commented out. When cmp.enableTLS=true, provide a valid cmp.tlsTrustedCerts path.