Bug 1535797
| Summary: | ExternalCA: Failures when installed with hsm | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Geetika Kapoor <gkapoor> | ||||||||
| Component: | pki-core | Assignee: | Endi Sukma Dewata <edewata> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | 7.5 | CC: | edewata, enewland, mharmsen | ||||||||
| Target Milestone: | rc | Keywords: | Regression | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | pki-core-10.5.1-7.el7 | Doc Type: | No Doc Update | ||||||||
| Doc Text: |
undefined
|
Story Points: | --- | ||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2018-04-10 17:04:05 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
On further investigation, I could see that ExternalCA has failures in debug logs.Attaching the logs in the bugzilla for further investigation. [24/Jan/2018:02:47:45][http-bio-27443-exec-3]: CertInfoProfile: Unable to populate certificate: Unable to get ca certificate: Unable to initialize, java.io.IOException: DerInput.getLength(): lengthTag=9, too big. Unable to get ca certificate: Unable to initialize, java.io.IOException: DerInput.getLength(): lengthTag=9, too big. at com.netscape.cms.profile.def.ValidityDefault.populate(ValidityDefault.java:323) at com.netscape.certsrv.profile.CertInfoProfile.populate(CertInfoProfile.java:100) at com.netscape.cms.servlet.csadmin.CertUtil.createLocalCert(CertUtil.java:539) at com.netscape.cms.servlet.csadmin.ConfigurationUtils.configLocalCert(ConfigurationUtils.java:2785) at com.netscape.cms.servlet.csadmin.ConfigurationUtils.configCert(ConfigurationUtils.java:2609) at org.dogtagpki.server.rest.SystemConfigService.processCert(SystemConfigService.java:476) at org.dogtagpki.server.rest.SystemConfigService.processCerts(SystemConfigService.java:303) at org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:166) at org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:101) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:280) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:234) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:221) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:731) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237) at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191) at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) Caused by: Unable to initialize, java.io.IOException: DerInput.getLength(): lengthTag=9, too big. at com.netscape.ca.CertificateAuthority.getCACert(CertificateAuthority.java:1618) at com.netscape.cms.profile.def.ValidityDefault.populate(ValidityDefault.java:315) ... 70 more Caused by: java.security.cert.CertificateException: Unable to initialize, java.io.IOException: DerInput.getLength(): lengthTag=9, too big. at netscape.security.x509.X509CertImpl.<init>(X509CertImpl.java:186) at netscape.security.x509.X509CertImpl.<init>(X509CertImpl.java:160) at com.netscape.ca.CertificateAuthority.getCACert(CertificateAuthority.java:1610) ... 71 more Created attachment 1385296 [details]
debug
Created attachment 1385341 [details]
debug logs
Fixed in upstream 10.5 branch: * https://github.com/dogtagpki/pki/commit/75542c58f88f204c2f80d029946e65df7c26a54f * https://github.com/dogtagpki/pki/commit/094d238a75f0335f9c374f65f0bc1d913ea49444 * https://github.com/dogtagpki/pki/commit/9431707fb93c000dcdd0eb89516dfc09bd5e55ac * https://github.com/dogtagpki/pki/commit/6cc361d6c5776b96037910d6bc0811d145f725db * https://github.com/dogtagpki/pki/commit/9ad1d47bee65a76b878d6c2298e7bcbc345df31f I am seeing similar error as mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1535797#c4 when I am trying to install scenario's like: RootCA --> externalCA(cmc) ---> another externalCA (cmc) (Level1) (Level2) (level3) Level1 -- worked Level2 -- worked Level3 -- failure Raising a related bug -- https://bugzilla.redhat.com/show_bug.cgi?id=1540924 Since this bug resolves the other issue Test Env:
========
rpm -qa pki-* jss* nss*
nss-softokn-devel-3.34.0-2.el7.x86_64
nss-softokn-3.34.0-2.el7.x86_64
nss-3.34.0-4.el7.x86_64
pki-tools-10.5.1-7.el7.x86_64
pki-ca-10.5.1-7.el7.noarch
pki-core-debuginfo-10.5.1-6.1.el7pki.x86_64
nss-pem-1.0.3-4.el7.x86_64
nss-sysinit-3.34.0-4.el7.x86_64
nss-util-devel-3.34.0-2.el7.x86_64
nss-softokn-freebl-devel-3.34.0-2.el7.x86_64
nss-devel-3.34.0-4.el7.x86_64
pki-javadoc-10.5.1-6.1.el7.noarch
pki-base-10.5.1-7.el7.noarch
pki-symkey-10.5.1-7.el7.x86_64
pki-server-10.5.1-7.el7.noarch
pki-kra-10.5.1-7.el7.noarch
pki-tks-10.5.1-6.1.el7pki.noarch
pki-console-10.5.1-4.el7pki.noarch
nss-softokn-freebl-3.34.0-2.el7.x86_64
nss-util-3.34.0-2.el7.x86_64
jss-4.4.0-11.el7.x86_64
nss-tools-3.34.0-4.el7.x86_64
pki-base-java-10.5.1-7.el7.noarch
pki-tps-10.5.1-6.1.el7pki.x86_64
pki-ocsp-10.5.1-6.1.el7pki.noarch
Test Steps:
===========
1. Install a RootCA.
2. Try to install ExternalCA1 and ExternalCA2.
3. Installation worked as expected.On same HSM it worked
4. If RootCA is on nfast and ExternalCA1 is also on nfast and we try to configure ExternalCA2 on soft card that scenario never worked.
5. Make sure all externalCA have their own security domain.
# pki -p 25080 securitydomain-show
Domain: SECure-Ds
CA Subsystem:
Host ID: CA csqa4-guest04.idm.lab.eng.rdu.redhat.com 25443
Hostname: csqa4-guest04.idm.lab.eng.rdu.redhat.com
Port: 25080
Secure Port: 25443
Domain Manager: TRUE
KRA Subsystem:
Host ID: KRA csqa4-guest04.idm.lab.eng.rdu.redhat.com 21443
Hostname: csqa4-guest04.idm.lab.eng.rdu.redhat.com
Port: 21080
Secure Port: 21443
Domain Manager: FALSE
# pki -p 31080 securitydomain-show
Domain: idm.lab.eng.rdu.redhat.com Security Domain
CA Subsystem:
Host ID: CA csqa4-guest04.idm.lab.eng.rdu.redhat.com 31443
Hostname: csqa4-guest04.idm.lab.eng.rdu.redhat.com
Port: 31080
Secure Port: 31443
Domain Manager: TRUE
# pki -p 28080 securitydomain-show
Domain: idm.lab.eng.rdu.redhat.com Security Domain
CA Subsystem:
Host ID: CA csqa4-guest04.idm.lab.eng.rdu.redhat.com 28443
Hostname: csqa4-guest04.idm.lab.eng.rdu.redhat.com
Port: 28080
Secure Port: 28443
Domain Manager: TRUE
RootCA -- 25443
Certificate:
Data:
Version: v3
Serial Number: 0xCDD0C20
Signature Algorithm: SHA512withRSA - 1.2.840.113549.1.1.13
Issuer: CN=CA Signing Certificate,OU=gkapoor_RHCS_75_ssl,O=SECure-Ds
Validity:
Not Before: Sunday, February 11, 2018 2:18:29 PM EST America/New_York
Not After: Thursday, February 11, 2038 2:18:29 PM EST America/New_York
Subject: CN=CA Signing Certificate,OU=gkapoor_RHCS_75_ssl,O=SECure-Ds
Extensions:
Identifier: Authority Key Identifier - 2.5.29.35
Critical: no
Key Identifier:
5E:C4:35:09:6C:B1:24:3C:E5:06:46:E8:38:66:1C:4C:
95:8C:A3:46
Identifier: Subject Key Identifier - 2.5.29.14
Critical: no
Key Identifier:
5E:C4:35:09:6C:B1:24:3C:E5:06:46:E8:38:66:1C:4C:
95:8C:A3:46
ExternalCA1 --31080
Certificate contents
Certificate:
Data:
Version: v3
Serial Number: 0xF85104A
Signature Algorithm: SHA512withRSA - 1.2.840.113549.1.1.13
Issuer: CN=CA Signing Certificate,OU=gkapoor_RHCS_75_ssl,O=SECure-Ds
Validity:
Not Before: Tuesday, February 13, 2018 2:00:15 PM EST America/New_York
Not After: Thursday, November 5, 2037 2:00:15 PM EST America/New_York
Subject: CN=CA Signing Certificate,OU=gkapoor-ecc-exca,O=idm.lab.eng.rdu.redhat.com Security Domain
Extensions:
Identifier: Authority Key Identifier - 2.5.29.35
Critical: no
Key Identifier:
5E:C4:35:09:6C:B1:24:3C:E5:06:46:E8:38:66:1C:4C:
95:8C:A3:46
Identifier: Subject Key Identifier - 2.5.29.14
Critical: no
Key Identifier:
44:60:EF:13:78:08:96:46:DD:59:66:0A:2C:6E:3C:7C:
D6:B4:97:39
ExternalCA2 -- 28080
Certificate:
Data:
Version: v3
Serial Number: 0x24
Signature Algorithm: SHA512withRSA - 1.2.840.113549.1.1.13
Issuer: CN=CA Signing Certificate,OU=gkapoor-ecc-exca,O=idm.lab.eng.rdu.redhat.com Security Domain
Validity:
Not Before: Wednesday, February 14, 2018 7:59:49 AM EST America/New_York
Not After: Thursday, November 5, 2037 2:00:15 PM EST America/New_York
Subject: CN=CA Signing Certificate,OU=gkapoor-ecc-exca1,O=idm.lab.eng.rdu.redhat.com Security Domain
Extensions:
Identifier: Authority Key Identifier - 2.5.29.35
Critical: no
Key Identifier:
44:60:EF:13:78:08:96:46:DD:59:66:0A:2C:6E:3C:7C:
D6:B4:97:39
Identifier: Subject Key Identifier - 2.5.29.14
Critical: no
Key Identifier:
BB:2F:66:11:73:36:79:D8:A9:34:19:9B:3A:68:12:9D:
6F:4A:E5:19
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0925 |
Created attachment 1382757 [details] config Description of problem: Trying to do externalCA with hsm instance and i could see some failures. Also, It asks password in the mid of installation and i have to enter manually. Version-Release number of selected component (if applicable): rpm -qa pki-* pki-symkey-10.5.1-5.1.el7.x86_64 pki-base-java-10.5.1-5.1.el7.noarch pki-core-debuginfo-10.5.1-5.1.el7pki.x86_64 pki-ocsp-10.5.1-5.1.el7pki.noarch pki-server-10.5.1-5.1.el7.noarch pki-javadoc-10.5.1-5.1.el7.noarch pki-kra-10.5.1-5.1.el7.noarch pki-tools-10.5.1-5.1.el7.x86_64 pki-base-10.5.1-5.1.el7.noarch pki-ca-10.5.1-5.1.el7.noarch rpm -qa jss* jss-4.4.0-10.1.el7.x86_64 How reproducible: always Steps to Reproduce: 1.Follow 2 step procedure.Install with step1 config. 2.change ciphers in server.xml 3.proceed with step 2 installation Actual results: Installation failed Expected results: Installation should work Additional info: