Set up SPIFFE/SPIRE Workload Identity Management with EJBCA PKI.
The Secure Production Identity Framework for Everyone (SPIFFE) is an open-source standard for securely identifying software systems in dynamic, diverse environments. It enables seamless, reliable mutual authentication across any runtime.
SPIRE is a production-ready SPIFFE implementation that handles node and workload attestation to securely issue and verify SVIDs based on predefined conditions.
The Keyfactor SPIRE Upstream Authority plugin integrates SPIRE with EJBCA PKI, enabling organizations to standardize their PKI on a single, unified platform.
In this tutorial, you will learn how to configure SPIRE to use the EJBCA UpstreamAuthority Plugin. This integration allows SPIRE to issue workload identity certificates as part of a trusted PKI managed by EJBCA.
Follow this tutorial if you want to leverage SPIRE as an implementation of the SPIFFE framework for secure workload identity and EJBCA for workload identity issuance.
Here are the steps:
Before you begin, you need a running EJBCA container with:
Additionally, you need:
Note: SPIRE currently only allows using a fixed internal CA as its default and functions as the issuing CA. EJBCA can be used as an external trust chain to accept a CSR from SPIRE and provide a signed sub-CA certificate, allowing for control over the PKI trust chain used internally in SPIRE as well as providing for multi-cloud or multi-provider trust.
Check out our How-To guide for using the EJBCA UpstreamAuthority plugin to enable SPIRE to issue workload identities as part of a trusted PKI using EJBCA.
Get your hands on the EJBCA UpstreamAuthority plugin for SPIRE Server on the Keyfactor GitHub
Get your hands on the EJBCA UpstreamAuthority plugin for SPIRE Server on the SPIFFE GitHub
You can ask your questions and learn from PKI specialists in the EJBCA forum on GitHub Discussions.
