Create ITS Certificate Profile

To create an ITS certificate profile, do the following:

1. Click Certificate Profiles under CA Functions to open the Manage Certificate Profiles page.

2. To add the new certificate profile, specify a name for the profile at the bottom row, and click Add.

3. Find your new certificate profile in the list, and click Edit.

4. Edit the settings according to the following:

   • As Type for the profile, select ITS.

   • In the Validity or end date of the certificate field, enter the maximum validity of the ITS-S certificate or EC, for example 2y 5h.

   • Select the relevant Application Permissions to be considered when a certificate is used for certain C-ITS applications like cooperative message sending.

   • Select the relevant Certificate Issuing Permissions to restrict what certificates the CA can issue.
     

     

5. Click Save to store the settings and view the new certificate profile in the list.

Create ECA

To create the Enrollment Certification Authority (ECA), do the following:

1. Click the menu option Certification Authorities under CA Functions to open the Manage Certification Authorities page.

2. In the Add CA field, enter a name for the CA and click Create.

3. On the Create CA page, specify the following:
   

   • As CA Type, select ECA.

   • If no Crypto Token is selected, a soft token will be generated based on the signing algorithm. For example, NIST P256 for SHA256withECDSA and Brainpool384r1 for SHA384withECDSA. Note that HSM based tokens are currently not supported for ECA.

   • Under C-ITS Certificate Data, specify the following:

     • The Certificate Id needs to be globally (not just in EJBCA) unique and will be included in the CSR and thus in the certificate.

     • Select the newly created Certificate Profile.

     • Specify the Validity Period.

     • Optionally, indicate in which geographic region the certificate is valid in the section Select ITS geographic regions:

       • Select a type, click Add and input the region in the specified format in the text field. EJBCA supports circular, rectangular, and identified European countries. A Circular region is not a sequence like the other regions and multiple entries can be added by clicking Add. To remove an entry, select Remove and click Preview and remove selected.

   • Next, click Make certificate request to create the signed Certificate Signing Request (CSR). The CSR is created according to ETSI 102 941 (section 6.2.1).
     

     

   • Download the signed CSR by clicking Download binary file.
     

     

4. Click Create at the bottom of the page to finalize the CA.

The created ECA is now displayed in the List of Certificate Authorities on the Manage Certificate Authorities page.

Import CA Certificate

1. Select the menu option CA Functions > Certificate Authorities, and click Edit CA of the CA you created in the Create ECA section.

2. Scroll to the bottom of the CA properties page.

3. In the section Externally signed CA creation/renewal:
   

   • In section Step 2 - Import Certificate, click Browse to select the signed certificate file.

4. Click Receive Certificate Response to import the externally signed CA certificate and activate the CA.
   
   

   • Once the certificate is uploaded, you can inspect the certificate on the Edit CA page:
     
     

   • The Certificate hash displays the CA identifier, HashedId8. It is the last (right-most) 16 characters, thus 8 bytes.

   • The Expiry time displays the date and time for expiry.
     

To rollover the CA certificate, create another CSR by clicking Make Certificate Request to automatically generate a new key pair for encryption and verification and then import that certificate using the steps above. Subsequent certificate upload using the steps above will automatically rollover the CA certificate.

Note that in the uploaded certificate, the certificateId and public keys (both encryption and verification keys) are validated. This allows the Root CA to set different appPermissions and certIssuePermissions than the request ones. The updated permissions are not shown in the user interface.

Enable ITS Endpoints

To enable ITS REST endpoints:

1. Click EJBCA System Configuration and select the Protocol Configuration tab.

2. Enable the ITS Certificate Management protocol.
   
   

Enabling the ITS Certificate Management protocol enables the end entity management and operations described in ETSI 102 941 like enrollment or authorization validation.

Next, create an end entity profile and then register your first ITS-S.

Create End Entity Profile

1. Click Edit End Entity Profiles under RA Functions.

2. In the Add Profile field, specify a name for your end entity profile, and click Add.

3. Find the new end entity profile in the List of End Entity Profiles, and click Edit.

4. Edit the settings according to the following:

   • Enable Batch generation (clear text pwd storage).

   • In the Subject DN Attributes section, disable Required for CN, Common name.
     

     

   • In the Main Certificate Data section, select the Certificate Profile you created earlier or create another similar certificate profile of the type ITS from the multi-select options in Available Certificate Profiles.

     • Select the same certificate profile in Default Certificate Profile list.

     • Do the same for the CAs and select Available CAs and then update the Default CA.
       

5. Scroll down to the bottom of the page and click Save.

Register ITS-S and Fetch Registered Data

Following ETSI specifications, the EA must know the ITS-S in terms of a globally unique Canonical ID and a Canonical Public Key. In, EJBCA, this is referred to as registration and is performed through REST endpoints.

Access EJBCA ITS REST Interface using Swagger

The following examples use Swagger to interact with the REST endpoints. Note that this is only available in EJBCA running non-production mode. Any REST client could be used to perform the same operations. To access the EJBCA ITS REST Interface using Swagger, perform the following steps:

1. Navigate to https://hostnamet:8443/ejbca/swagger-ui#/.

2. In the Select a spec list, select ITS.
   

   

Register ITS-S End Entity

Follow these steps to register the ITS-S End Entity:

1. The ITS-S (end entity) should have a unique name, thus the Canonical ID (canonicalId).

2. Create a new ECC (Elliptic Curve Cryptography) key pair where the public key will be used for registration and the private key will be used for signing the first enrollment request. Generate the key pair using the following OpenSSL commands:

   openssl ecparam -name prime256v1 -genkey -noout -out canonical_key.pem
   openssl ec -in key.pem -pubout -out canonical_public_key.pem

3. The ITS-S registration request includes the following parameters. To download an example request text file, click register_request.txt.
   

   • canonicalId: A unique name for the ITS-S (end entity) known as the Canonical ID.

   • canonicalPublicKey: Use the public key (canonical_public_key.pem) and ensure to remove the newline parameters.

   • caName: Use the CA name created earlier.

   • certificateProfileName: Use the name of the Certificate Profile created earlier.

   • endEntityProfileName: Use the name of the End Entity Profile created earlier.

   • region: The geographic region is optional. Region can be expressed as a string in the following formats:

     • rectangle:12,23,34,56;78,90,76,65;

     • circular:123,56,125

     • identifed:country:Denmark;country_region:Belgium,123,45,34;

   • assuranceLevel: Optional. The assuranceLevel parameter value is a positive integer less than 256 as a string parameter.
     

     

4. On successful registration, a 200 response is generated.

Fetch Registered Data

Follow these steps to search for the ITS-S End Entity using the Canonical ID and view the registered ITS data.

1. In the Swagger EJBCA ITS REST Interface, select GET to search for the ITS endpoint:
   

   

2. Use the canonicalId to search or view the registered ITS:
   

   

ITS REST endpoints can also be used to edit, revoke, or delete an End Entity using the canonicalId as the its_name or its_canonicalId parameter.