Red Hat Bugzilla – Bug 1194349
test_pkcs12.py does not works in FIPS mode
Last modified: 2015-11-19 06:34:49 EST
Created attachment 993685 [details] Proposed patch Description of problem: Two test scripts provided by python-nss-doc are not working on FIPS mode: setup_certs.py test_pkcs12.py These are only a kind of examples but it would be nice to have versions which are working also in FIPS. Please note, they are executed during testing. Version-Release number of selected component (if applicable): python-nss-doc-0.16.0-2.el7 How reproducible: always Steps to Reproduce: The 1st problem is that setup_certs.py can not create certificates with command: # /usr/bin/certutil -S -x -d 'sql:pki' -f pwd -n test_ca -s 'CN=Test CA' -g 1024 -t 'CT,,CT' -1 -2 -5 -m 1 -v 12 certutil: unable to generate key(s) : SEC_ERROR_IO: An I/O error occurred during security authorization. The problem is the weak password used here: db_passwd = 'db_passwd' The 2nd problem is with test_export() in test_pkcs12.py. In FIPS salt is used and it appears in exported files. This cause that the comparison fails. I could not find better way that remove the salt from the string which are compared.
Thank you for reporting and the good analysis. fixed in upstream commit 103:6096d0660e2a
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2357.html