We used a static value ‘usernameTest’ as username to request EJBCA to generate X.509 certifcates; after generating certificates using this satic username we changed it to a unique value identifiying uniquely each certificate (Since using a static username is considered as a renew since the username is the same for all certificates (*) ) but now EJBCA refuses to generate certificates and stil reference the old static username ‘usernameTest’; we get this error:
User '250320092916' is not allowed to use same key as the user(s) ‘usernameTest’ is/are using.
We revoked all certificates previously generated for username 'usernameTest', but we still get this error message from EJBCA. Is there any way we can remove username 'usernameTest'?
Each certificate has a unique SubjectDN and username.
The version of EJBCA is ejbca-6.2.0.
(*): All generated certificates in EJBCA Administration GUI are related to the same username.
Thanks in advance.
Problem solved; the problem is not that a reference to usernameTest still in EJBCA but that the same key (RSA public key) is used for the request of the other user ('250320092916').
It seems this is a known limitation when relying on the HSM PTK-C simulator from the Safenet ProtectServer series; the simulator restarts its random generator when we re-initialize it (I suspect a misuse from me), which means it will always generate the same keys in the same order (which leads to such errors).
But also the message error is not clear; talking about the "key" without specifying, this leads to a confusion with subjectDN or other attributes communicated to the EJBCA, as an error message it may be "public key" or "RSA key", ... instead of key ;)