Bug 1894083
| Summary: | keytool is failing in FIPS mode, because OpenJDK doesn't depend on nss package | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Martin Perina <mperina> | |
| Component: | java-11-openjdk | Assignee: | Andrew John Hughes <ahughes> | |
| Status: | CLOSED ERRATA | QA Contact: | OpenJDK QA <java-qa> | |
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | 8.2 | CC: | ahughes, aipatil, awestbro, jvanek, zzambers | |
| Target Milestone: | rc | Keywords: | Triaged, ZStream | |
| Target Release: | 8.3 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | java-11-openjdk-11.0.10.0.9-2.el8 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1914057 (view as bug list) | Environment: | ||
| Last Closed: | 2021-05-18 15:30:50 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1875363, 1914057 | |||
Sorry for the slow response. I was only just made aware of this bug. It definitely looks like java-1.8.0-openjdk & java-11-openjdk need an explicit NSS dependency for the FIPS support. We'll get this added in the next update. Filed bug 1913868 to cover java-1.8.0-openjdk. Hi team, As per the KCS article [1] the fix for this was scheduled for january 2021 update release of Openjdk 11. I can see openJDK 11.0.10 GA has been released on 19th Jan 2021. Do we have any update on the fix of this issue? Is there any ETA for this? The queries are from the CU facing the same issue. [1] https://access.redhat.com/solutions/5691261 Thanks in advance. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (java-11-openjdk bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1794 |
Description of problem: As a part if RHV installation we are generating CA key and certificate using openssl, but we need to import CA certificate into java keystore. Everything works fine in standard RHEL installation, but there is an exception when RHEL is configure to use FIPS mode. Here is the command output: /usr/lib/jvm/jre-11-openjdk-11.0.9.11-2.el8_3.x86_64/bin/keytool -v -import -noprompt -trustcacerts -alias cacert -keypass mypass -file ca.pem -keystore .truststore -storepass mypass keytool error: java.security.ProviderException: Could not initialize NSS java.security.ProviderException: Could not initialize NSS at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:217) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:112) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:109) at java.base/java.security.AccessController.doPrivileged(Native Method) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:109) at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:251) at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:242) at java.base/java.security.AccessController.doPrivileged(Native Method) at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:242) at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:222) at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266) at java.base/sun.security.jca.ProviderList.getService(ProviderList.java:379) at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:157) at java.base/java.security.Security.getImpl(Security.java:717) at java.base/java.security.KeyStore.getInstance(KeyStore.java:875) at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:925) at java.base/sun.security.tools.keytool.Main.run(Main.java:405) at java.base/sun.security.tools.keytool.Main.main(Main.java:398) Caused by: java.io.FileNotFoundException: /usr/lib64/libnss3.so at jdk.crypto.cryptoki/sun.security.pkcs11.Secmod.initialize(Secmod.java:193) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:212) ... 17 more Shouldn't OpenJDK package depend on nss package to prevent that failure? More details are in dependent bug: BZ1875363 Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: