How to configure EJBCA to run in dual stack mode (IPV4 and or/ IPV6)

[Krisscut]

Hi,

I'm trying to run EJBCA 9.1.1 Community (8207be0e6112067a33b82328d8e15870b5492da7) in dual stack mode, meaning to be able to serve both request coming on its IPV4 and IPV6 addresses.

This is to serve the CMP capability on both addresses.
When I try to run the CMP procedure on the IPV6 address it doesn't seem to be visible in the ejbca traces.

I tried to search the documentation but I don't see anything.
I guess this is done at the wildfly configuration level ?

[primetomas]

Yes you configure WildFly to listen to the interfaces and ports you like, EJBCA just consumes what WildFly passes through the TLS stack.

[Krisscut]

Thanks for the quick answer and confirming it should work, I will look into how to configure this.

[Krisscut]

I'm using docker from keyfactor/ejbca-ce:latest, how to you recommend to change the configuration of the wildfly server that is embedded ?

Should I download the original file and override it through a mounting point ?

I see in the startup scripts located under \opt\keyfactor\bin\internal\after-deployed.sh that it seems to edit the wildfly configuration at runtime. (functions defined under \opt\keyfactor\bin\internal\functions-appserver)

[primetomas]

In a container you can override things with mounts, init containers, or some other method that kubernetes and platforms provide. Many different ways....

[dobicinaitis]

Hi, I believe you don't need to configure anything extra in the container, as WildFly listens on both IPv6 and IPv4 addresses.

Here's a quick test I ran using Docker to confirm that port 8080 is published on both IPv6 and IPv4:

docker run --rm -it -p 8080:8080 keyfactor/ejbca-ce

Once the container has spun up, you can verify IPv6 connectivity by making a request to the IPv6 loopback address:

curl -v http://[::1]:8080/ejbca/publicweb/healthcheck/ejbcahealth
# *   Trying [::1]:8080...
# * Connected to ::1 (::1) port 8080
# ...
# ALLOK

And IPv4 connectivity using 127.0.0.1:

curl -v http://127.0.0.1:8080/ejbca/publicweb/healthcheck/ejbcahealth
# *   Trying 127.0.0.1:8080...
# * Connected to 127.0.0.1 (127.0.0.1) port 8080
# ...
# ALLOK

[Krisscut]

Hi, I believe you don't need to configure anything extra in the container, as WildFly listens on both IPv6 and IPv4 addresses.

Here's a quick test I ran using Docker to confirm that port 8080 is published on both IPv6 and IPv4:

docker run --rm -it -p 8080:8080 keyfactor/ejbca-ce

Once the container has spun up, you can verify IPv6 connectivity by making a request to the IPv6 loopback address:

curl -v http://[::1]:8080/ejbca/publicweb/healthcheck/ejbcahealth
# *   Trying [::1]:8080...
# * Connected to ::1 (::1) port 8080
# ...
# ALLOK

And IPv4 connectivity using 127.0.0.1:

curl -v http://127.0.0.1:8080/ejbca/publicweb/healthcheck/ejbcahealth
# *   Trying 127.0.0.1:8080...
# * Connected to 127.0.0.1 (127.0.0.1) port 8080
# ...
# ALLOK

Hi !

Yes you are right !

I think I got confused at the some point because it wasn't working when I was trying to reach it with my CMP client, but around the same time I noticed the IPv6 I provided to the CMP Client was missing [] around it and it wasn't complaining about it, just failing to connect.

So I assumed it was related to some wildfly configuration because I tried to tuned things and got it working around the same time as when I fixed the missing brackets.

I tried without my wildfly configurations changes and I still connect fine in IPV6 !

Sorry about this, thanks to both of you for your replies !