Deploy EJBCA with Ansible

How to get started

Our open-source Ansible playbook is available on GitHub. It is capable of performing the following high-level tasks:

• Install and upgrade EJBCA Community and Enterprise editions
• Configure external RAs and VAs or a standalone CA (EJBCA Enterprise only)
• Deploy and configure SignServer

Learn step by step from this video tutorial 

In this tutorial, we will demonstrate how to automate the wizard installation and configuration of EJBCA Enterprise Cloud using our open-source Ansible playbook for a zero-touch PKI experience. The playbook uses a variety of Ansible roles developed for EJBCA to automate the deployment and configuration. 

The installation and configuration of EJBCA Cloud include these steps:

• Launch the EJBCA Enterprise Cloud AMI/VM from the AWS or Azure marketplace. Make sure the private key you select is configured on your Ansible controller to connect using SSH to the EJBCA instance in the cloud.
• Download the Keyfactor Ansible repository to your Ansible controller. Once the repository is downloaded you can update the ecloud_inventory file with the IP address or fully qualified domain name to connect to the remote EJBCA instance.
• Review the host_vars and group_vars to update variables for your deployment. If you are unsure about what to update, you can try deploying with the defaults, or you can ask a question on the Keyfactor Ansible repository Discussion forum.
• At this point, you should be able to run the Ansible playbook and review the output of the tasks as EJBCA is configured. 

Running the Ansible playbook

Running the Ansible playbook to configure EJBCA automates the following steps:

• Provide configuration to the installation wizard for a zero-touch experience with the EJBCA setup
• Create a crypto token for the Root and Sub CA
• Generate keys on the crypto token for the Root CA and Sub CA
• Use the EJBCA Enterprise configdump utility to complete the following:
  • Import certificate profiles for the Root CA and Sub CA
  • Initialize the Root CA and Sub CA
  • Import certificate profiles for end entities
  • Import end entity profiles used to create and issue certificates for end entities
  • Configure EJBCA services such as the CRL update service
  • Configure EJBCA enrollment protocols such as ACME, EST, SCEP, and REST API endpoints
  • Configure roles that can be used for testing various permissions in the PKI 

Once the Ansible playbook has completed, open the EJBCA RA web in your internet browser and create your P12 credential to access EJBCA. Install the P12 credential into either the OS truststore or browser truststore depending on which browser you use. Then you can access the EJBCA adminweb UI in your web browser and review the EJBCA settings or begin testing certificate enrollment.

Prerequisites

Before you begin, you will need: 

• AWS or Azure account with permission to deploy EJBCA from the marketplace
• Network access to GitHub to download the Keyfactor Ansible repository
• Network access to the EJBCA Cloud instance; this could be a host in the cloud, if you run Ansible there
• Ansible controller that can access the EJBCA Cloud instance using SSH
• Familiarity with Ansible playbooks, roles, and the YAML format