Red Hat Bugzilla – Bug 1582747
DS only accepts RSA and Fortezza cipher families
Last modified: 2018-10-30 06:14:33 EDT
Description of problem: Currently DS only accepts fortezza and RSA cipher families. This prevents things like ECC certificates from being used. @rcritten found the issue in ldap/servers/slapd/ssl.c, and pointed out that nunc-stans tls code was already doing the right thing, but not the core server code. Upstream ticket: https://pagure.io/389-ds-base/issue/49726
Fixed upstream
Asha, QE is asking for a basic reproducer on this. Can you provide the steps needed to generate ECC certificates? From the DS side the SSL initialization failed, and the server would not listen on the secure port. [25/May/2018:16:26:17.052973659 -0400] - WARN - Security Initialization - SSL alert: ConfigSecureServer: Server key/certificate is bad for cert DS Certificate of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8187 - security library: invalid arguments.) [25/May/2018:16:26:17.074510928 -0400] - ERR - Security Initialization - SSL failure: None of the cipher are valid With the current fix it just works. There is no special configuration needed on the DS side to use ECC certificates.
The certutil command has options to create ECC certificates. To generate a ECC key/certificate use the options "-k ec -q <curve-name>". <curve-name> is the elliptic curve name that you are testing. "certutil -G --help" shows all the available curves. Here is an example for cert creation using curve nistp256: The file /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/password.txt is owned by directory server user (example: dirsrv) and it has nss database password. # cd /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/ # openssl rand -out noise.bin 2048 # echo -e "0\n1\n2\n3\n9\ny\n" | \ certutil -S -x \ -d /etc/dirsrv/slapd-<DS-INSTANCE-NAME> \ -f /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/password.txt \ -z noise.bin \ -n "DS Certificate" \ -s "CN=$HOSTNAME" \ -k ec \ -q nistp256 \ -Z SHA256 \ -t "CT,C,C" \ -m $RANDOM\ -1 # certutil -L -d /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI DS Certificate CTu,Cu,Cu
Build tested: 389-ds-base-1.3.8.4-3.el7.x86_64 TLS is initialized: [11/Jul/2018:08:22:08.157828878 -0400] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2 List of certificate in the DB: [root@qeos-54 slapd-DS]# certutil -K -d /etc/dirsrv/slapd-DS/ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> ec 4ad944d1958e6625a7d82df4db5eaa50700876e0 NSS Certificate DB:Server-Cert < 1> ec 76af609b3ec710364b2ae50d8183ad5bb126256a NSS Certificate DB:CA certificate [root@qeos-54 slapd-DS]# ss -ntpl | grep ns-slapd LISTEN 0 128 :::636 :::* users:(("ns-slapd",pid=30535,fd=8)) LISTEN 0 128 :::389 :::* users:(("ns-slapd",pid=30535,fd=7)) The server is running, also able to bind on the LDAPS port.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:3127