"Enforce unique DN" as CA setting and removed End Entity/cert revoked - does not allow to issue new cert with same domain.

[drjoms]

Hello,

In my lab, I am running this:
Version : EJBCA 9.3.7 Community (afce321eed98ab06bd8cc78e89fc50b73a5b8db4)
This is docker instance.

I have valid cert mldsa.darthfrog.org(ML-DSA-65 keypair, which is cool as heck to run on my raspberry pi! thanks!)
I want to create new one: www.darthfrog.org(through same trust chain as above, all trust links including EE and root CA are ML-DSA)

Caused by: org.cesecore.certificates.certificate.CertificateCreateException: User 'www' is not allowed to use same subject DN as the user(s) 'mldsawww' is/are using while issued by the same CA (even if CN postfix is used). See setting for 'Enforce unique DN' in the section Certification Authorities.

I was playing around with my domain.
long story short. there is only ONE active End Entity with cn remotely similar to darthfrog.org

CA 	Profile 	Serial Number 	Subject 	Issued 	Expires 	Status 	External Account ID 	End Entity ▼ 	
SubCA ML-DSA 	
EMPTY
/ ENDUSER
	
48abebcfa42e8f962150cb2f5136481e703f5138
(414881304972144247837540044019580822518627258680)
	
CN=mldsa.darthfrog.org
dNSName=mldsa.darthfrog.org
	2026-10-23 19:42:25+00:00 	2028-10-22 19:42:24+00:00 	
Active
	
	[mldsa](https://192.168.2.2/ejbca/ra/endentity.xhtml?ee=mldsa)

There are now a few deleted entities that no longer exist on the system.(i removed them over RA)
Their certificates are revoked.

But I can not create new cert, like www.darthfrog.org, even though, as far as I understand - its unique from mldsa.darthfrog.org?
That seems super odd to me.

Seeking for End Entity "mldsawww" in RA interface brings no result(as I deliberately nuked anything related to "dartfrog.org")

Is this a bug or I don't understand something? If EE does not exist and its certs are all revoked, can I not issue certs with same SAN/CN?

I have a background in CA technical support and QA. If you require additional reproduction steps—such as testing across different CA hierarchies or testing with different signature algorithms (e.g., RSA vs. ML-DSA)—please let me know. I am happy to provide further data to help isolate the cause. Assuming the cause is not between left and right ear of the submitter. :D

[ChangkeunJ]

Not a bug, the check just runs against stored certificates rather than end entities. EJBCA looks up every cert with that subject DN issued by the same CA and compares usernames, with no status filter, so the revoked cert mldsawww once had for CN=www.darthfrog.org still counts after the end entity is gone (search certificates with the Username box ticked for mldsawww and it's still there). Either create the new end entity as mldsawww, or turn off Enforce unique DN on the CA since it's a lab.

[drjoms]

Thank you for response.
I am not saying its a bug, but just may be, error message could have been improved?

[ChangkeunJ]

Agreed, "is/are using" is the misleading part. The check goes by stored certificates: CertificateCreateSessionBean asks for every username that has a cert with that subject DN from that CA, with no status filter, so the revoked one from the deleted end entity still matches. I've sent #1085 to reword it so it says that and names the two ways out. Same placeholders and error code, only the text changes.