Fixed upstream

Asha,

QE is asking for a basic reproducer on this.  Can you provide the steps needed to generate ECC certificates?



From the DS side the SSL initialization failed, and the server would not listen on the secure port.

[25/May/2018:16:26:17.052973659 -0400] - WARN - Security Initialization - SSL alert: ConfigSecureServer: Server key/certificate is bad for cert DS Certificate of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8187 - security library: invalid arguments.)
[25/May/2018:16:26:17.074510928 -0400] - ERR - Security Initialization - SSL failure: None of the cipher are valid

With the current fix it just works.  There is no special configuration needed on the DS side to use ECC certificates.

The certutil command has options to create ECC certificates. To generate a ECC key/certificate use the options  "-k ec -q <curve-name>". <curve-name> is the elliptic curve name that you are testing. "certutil -G --help" shows all the available curves.

Here is an example for cert creation using curve nistp256:

The file /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/password.txt is owned by directory server user (example: dirsrv) and it has nss database password.

# cd /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/
# openssl rand -out noise.bin 2048
# echo -e "0\n1\n2\n3\n9\ny\n" | \
certutil -S -x \
-d /etc/dirsrv/slapd-<DS-INSTANCE-NAME> \
-f /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/password.txt  \
-z noise.bin \
-n "DS Certificate" \
-s "CN=$HOSTNAME" \
-k ec \
-q nistp256 \
-Z SHA256 \
-t "CT,C,C" \
-m $RANDOM\
-1

# certutil -L -d /etc/dirsrv/slapd-<DS-INSTANCE-NAME>/

Certificate Nickname                                     	Trust Attributes
                                                        	SSL,S/MIME,JAR/XPI

DS Certificate                                           	CTu,Cu,Cu

Build tested: 389-ds-base-1.3.8.4-3.el7.x86_64

TLS is initialized:

[11/Jul/2018:08:22:08.157828878 -0400] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2

List of certificate in the DB:

[root@qeos-54 slapd-DS]# certutil -K -d /etc/dirsrv/slapd-DS/
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> ec       4ad944d1958e6625a7d82df4db5eaa50700876e0   NSS Certificate DB:Server-Cert
< 1> ec       76af609b3ec710364b2ae50d8183ad5bb126256a   NSS Certificate DB:CA certificate

[root@qeos-54 slapd-DS]# ss -ntpl | grep ns-slapd
LISTEN     0      128         :::636                     :::*                   users:(("ns-slapd",pid=30535,fd=8))
LISTEN     0      128         :::389                     :::*                   users:(("ns-slapd",pid=30535,fd=7))

The server is running, also able to bind on the LDAPS port.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:3127