Bug 1466495 - TPS installation on shared instance fails in FIPS/HSM environment
TPS installation on shared instance fails in FIPS/HSM environment
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core (Show other bugs)
7.4
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: RHCS Maintainers
Asha Akkiangady
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-29 15:57 EDT by Roshni
Modified: 2017-07-05 12:29 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-30 15:18:52 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
CA installation file (2.98 KB, text/plain)
2017-06-29 15:57 EDT, Roshni
no flags Details
KRA installation file (3.05 KB, text/plain)
2017-06-29 15:57 EDT, Roshni
no flags Details
TKS installation file (2.38 KB, text/plain)
2017-06-29 15:58 EDT, Roshni
no flags Details
TPS installation file (2.87 KB, text/plain)
2017-06-29 15:58 EDT, Roshni
no flags Details
pkispawn TPS error (27.83 KB, text/plain)
2017-06-29 15:59 EDT, Roshni
no flags Details

  None (edit)
Description Roshni 2017-06-29 15:57:25 EDT
Created attachment 1292955 [details]
CA installation file

Description of problem:
TPS installation on shared instance fails in FIPS/HSM environment

Version-Release number of selected component (if applicable):
pki-ca-10.4.1-10.el7.noarch

How reproducible:
always

Steps to Reproduce:
1. Attaching the installation files used for CA, KRA, TKS,TPS and the pkispawn error message
2.
3.

Actual results:


Expected results:


Additional info:
journalctl messages

Jun 29 14:55:18 pki1.example.com server[901]: Exception in thread "http-bio-30042-exec-7" java.lang.NoClassDefFoundError: org/mozilla/jss/ssl/SSLAlertEvent
Jun 29 14:55:18 pki1.example.com server[901]: at org.dogtagpki.server.PKIServerSocketListener.alertSent(PKIServerSocketListener.java:96)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.net.jss.TomcatJSS.alertSent(TomcatJSS.java:59)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SSLSocket.fireAlertSentEvent(SSLSocket.java:775)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SocketBase.socketClose(Native Method)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SocketBase.close(SocketBase.java:105)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SSLSocket.close(SSLSocket.java:743)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:328)
Jun 29 14:55:18 pki1.example.com server[901]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
Jun 29 14:55:18 pki1.example.com server[901]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
Jun 29 14:55:18 pki1.example.com server[901]: at java.lang.Thread.run(Thread.java:748)
Jun 29 14:55:18 pki1.example.com server[901]: Exception in thread "http-bio-30042-exec-8" java.lang.NoClassDefFoundError: org/mozilla/jss/ssl/SSLAlertEvent
Jun 29 14:55:18 pki1.example.com server[901]: at org.dogtagpki.server.PKIServerSocketListener.alertSent(PKIServerSocketListener.java:96)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.net.jss.TomcatJSS.alertSent(TomcatJSS.java:59)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SSLSocket.fireAlertSentEvent(SSLSocket.java:775)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SocketBase.socketClose(Native Method)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SocketBase.close(SocketBase.java:105)
Jun 29 14:55:18 pki1.example.com server[901]: at org.mozilla.jss.ssl.SSLSocket.close(SSLSocket.java:743)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:328)
Jun 29 14:55:18 pki1.example.com server[901]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
Jun 29 14:55:18 pki1.example.com server[901]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
Jun 29 14:55:18 pki1.example.com server[901]: at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
Jun 29 14:55:18 pki1.example.com server[901]: at java.lang.Thread.run(Thread.java:748)
Comment 2 Roshni 2017-06-29 15:57 EDT
Created attachment 1292956 [details]
KRA installation file
Comment 3 Roshni 2017-06-29 15:58 EDT
Created attachment 1292957 [details]
TKS installation file
Comment 4 Roshni 2017-06-29 15:58 EDT
Created attachment 1292958 [details]
TPS installation file
Comment 5 Roshni 2017-06-29 15:59 EDT
Created attachment 1292959 [details]
pkispawn TPS error
Comment 6 Roshni 2017-06-30 15:18:52 EDT
TKS installation config file was missing the following params

pki_hsm_enable=True
pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
pki_hsm_modulename=nfast

and the audit signing cert was not created under HSM. Once I fixed the above TPS installation went through fine and the agent pages are accessible for all subsystems. tpsclient token enroll/format were successful too.

Note You need to log in before you can comment on or make changes to this bug.