Bug 1401809

Summary: certutil does not announce correct password requirements in FIPS mode
Product: Red Hat Enterprise Linux 7 Reporter: Standa Laznicka <slaznick>
Component: nssAssignee: Daiki Ueno <dueno>
Status: CLOSED ERRATA QA Contact: Hubert Kario <hkario>
Severity: medium Docs Contact: Mirek Jahoda <mjahoda>
Priority: medium    
Version: 7.3CC: cww, ekeck, hkario, kengert, mjahoda, omoris, rrelyea, szidek
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-3.34.0-0.1.beta1.el7 Doc Type: Known Issue
Doc Text:
*certutil* does not return the NSS database password requirements in FIPS mode When creating a new Network Security Services (NSS) database with the *certutil* tool, the user has nowhere to find out what the database password requirements are when running in FIPS mode. The prompt message does not provide password requirements, and *certutil* returns only a generic error message: certutil: could not authenticate to token NSS FIPS 140-2 Certificate DB.: SEC_ERROR_IO: An I/O error occurred during security authorization.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 09:23:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1152173, 1420851    

Description Standa Laznicka 2016-12-06 07:15:30 UTC 
Description of problem:
When creating a new nss database with certutil, the user has nowhere to find out what should be included in the password to the databse if running in FIPS mode.

Version-Release number of selected component (if applicable):
nss-tools-3.21.3-2

How reproducible:
Always


Steps to Reproduce:
1. # certutil -N -d nssdb
2. User is being prompted for password, quote:
"The password should be at least 8 characters long,
and should contain at least one non-alphabetic character."
3. The user enters 10 characters long password which contains one digit.
4. # cat cert.der | certutil -d nssdb -A -n "CA Cert" -t 'C,,'

Actual results:
"certutil: could not authenticate to token NSS FIPS 140-2 Certificate DB.: SEC_ERROR_IO: An I/O error occurred during security authorization."

Expected results:
The password requirements are announced in the password prompt message otherwise the user is left to try database creations with different passwords until they finally find out what the requirements are.
Comment 2 Kai Engert (:kaie) (inactive account) 2017-02-24 14:06:57 UTC 
Stanislav, your request seems reasonable.

I'm not sure how quickly we could implement the changes upstream, it's probably too late for 7.4.0

I've filed an upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=1342412

We need a volunteer to implement this enhancement upstream.
Comment 11 errata-xmlrpc 2018-04-10 09:23:57 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0679