Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionAsha Akkiangady
2018-05-30 15:14:03 UTC
Description of problem:
Enabling Signed Audit logging fails when subsystem is installed with ECC.
Version-Release number of selected component (if applicable):
pki-ca-10.5.1-12.el7_5.noarch
pki-base-10.5.1-12.el7_5.noarch
How reproducible:
Steps to Reproduce:
1. Configure a CA with ECC. I used following pkispawn config file and FIPS enabled on the system, the pkispawn is successful.
[DEFAULT]
pki_instance_name=rhcs93-ECC-CA-<host>-aakkiang
pki_https_port=8443
pki_http_port=8080
#Token Password
pki_hsm_enable=True
pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
pki_hsm_modulename=nfast
pki_token_name=XXXXXXXX
pki_token_password=XXXXXXXXXX
pki_audit_signing_key_algorithm=SHA256withEC
pki_audit_signing_key_size=nistp256
pki_audit_signing_key_type=ecc
pki_audit_signing_signing_algorithm=SHA256withEC
pki_audit_signing_token=NHSM6000-OCS
pki_subsystem_key_algorithm=SHA256withEC
pki_subsystem_key_size=nistp256
pki_subsystem_key_type=ecc
pki_subsystem_signing_algorithm=SHA256withEC
pki_subsystem_token=NHSM6000-OCS
pki_sslserver_key_algorithm=SHA256withEC
pki_sslserver_key_size=nistp256
pki_sslserver_key_type=ecc
pki_sslserver_signing_algorithm=SHA256withEC
pki_sslserver_token=NHSM6000-OCS
#Admin
pki_admin_key_algorithm=SHA256withEC
pki_admin_key_size=nistp256
pki_admin_key_type=ecc
pki_admin_password=SECret.123
#Security Domain
pki_security_domain_hostname=nocp11.idm.lab.eng.rdu2.redhat.com
pki_security_domain_name=Example-rhcs93-ECC-CA
pki_security_domain_password=SECret.123
#client Dir
pki_client_dir=/opt/ECC_RootCA
pki_client_admin_cert_p12=/opt/ECC_RootCA/ecc_caadmincert.p12
pki_client_database_dir=/opt/ECC_RootCA/rootca/certs_db
pki_client_database_password=SECret.123
pki_client_pkcs12_password=SECret.123
pki_ds_ldap_port=389
pki_ds_bind_dn=cn=Directory Manager
pki_ds_password=SECret.123
pki_ds_secure_connection=True
pki_ds_ldaps_port=636
pki_ds_secure_connection_ca_pem_file=/tmp/ca_cert.pem
pki_ds_remove_data=True
[Tomcat]
pki_ajp_port=8009
pki_tomcat_server_port=8005
[CA]
pki_admin_nickname=PKI CA Administrator for ECC-Non-TMS-CA
pki_ca_signing_key_algorithm=SHA256withEC
pki_ca_signing_key_size=nistp256
pki_ca_signing_key_type=ecc
pki_ca_signing_signing_algorithm=SHA256withEC
pki_ca_signing_token=NHSM6000-OCS
pki_ocsp_signing_key_algorithm=SHA256withEC
pki_ocsp_signing_key_size=nistp256
pki_ocsp_signing_key_type=ecc
pki_ocsp_signing_signing_algorithm=SHA256withEC
pki_ocsp_signing_token=NHSM6000-OCS
pki_admin_name=caadmin
pki_admin_uid=caadmin
pki_admin_email=example
pki_import_admin_cert=False
pki_ds_hostname=XXXXXXXX
pki_ds_database=CC-ECC-NonTMS-LDAP
# Enable random serial numbers
pki_random_serial_numbers_enable=True
2. Enable signed audit logging: edit CS.cfg with log.instance.SignedAudit.logSigning=true
3. Restart CA.
Actual results:
debug log has the following:
[30/May/2018:01:51:30][localhost-startStop-1]: ===== DEBUG SUBSYSTEM INITIALIZED =======
[30/May/2018:01:51:30][localhost-startStop-1]: ============================================
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: restart at autoShutdown? false
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: autoShutdown crumb file path? /var/lib/pki/rhcs93-ECC-CA-nocp11-aakkiang/logs/autoShutdown.crumb
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: about to look for cert for auto-shutdown support:NHSM6000-OCS:auditSigningCert cert-rhcs93-ECC-CA-nocp11-aakkiang CA
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: found cert:NHSM6000-OCS:auditSigningCert cert-rhcs93-ECC-CA-nocp11-aakkiang CA
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: done init id=debug
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: initialized debug
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: initSubsystem id=log
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: ready to init id=log
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: init(): audit log signing enabled. signedAuditCertNickname=NHSM6000-OCS:auditSigningCert cert-rhcs93-ECC-CA-nocp11-aakkiang CA
[30/May/2018:01:51:30][localhost-startStop-1]: Event filters:
[30/May/2018:01:51:30][localhost-startStop-1]: - CMC_SIGNED_REQUEST_SIG_VERIFY: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - CMC_USER_SIGNED_REQUEST_SIG_VERIFY: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - DELTA_CRL_GENERATION: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - FULL_CRL_GENERATION: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - OCSP_GENERATION: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - RANDOM_GENERATION: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: - SELFTESTS_EXECUTION: (Outcome=Failure)
[30/May/2018:01:51:30][localhost-startStop-1]: Creating RollingLogFile(/var/lib/pki/rhcs93-ECC-CA-nocp11-aakkiang/logs/ca/signedAudit/ca_audit)
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: setting up log signing
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 0= Mozilla-JSS
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 1= SUN
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 2= SunRsaSign
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 3= SunEC
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 4= SunJSSE
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 5= SunJCE
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 6= SunJGSS
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 7= SunSASL
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 8= XMLDSig
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 9= SunPCSC
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: provider 10= CMS
[30/May/2018:01:51:30][localhost-startStop-1]: LogFile: setupSignig(): found cert:NHSM6000-OCS:auditSigningCert cert-rhcs93-ECC-CA-nocp11-aakkiang CA
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: in areRequestsDisabled
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine.forceShutdown()...begins graceful shutdown.
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine.autoShutdown(): ...with restart=false
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine: in areRequestsDisabled
SignedAudit: Failed to instantiate class com.netscape.cms.logging.RollingLogFile error: null
at com.netscape.cmscore.logging.LogSubsystem.init(LogSubsystem.java:140)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1056)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:962)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:568)
at com.netscape.certsrv.apps.CMS.init(CMS.java:187)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1602)
at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NullPointerException
at com.netscape.cmscore.profile.ProfileSubsystem.shutdown(ProfileSubsystem.java:225)
at com.netscape.cmscore.apps.CMSEngine.shutdownSubsystems(CMSEngine.java:2054)
at com.netscape.cmscore.apps.CMSEngine.autoShutdown(CMSEngine.java:2038)
at com.netscape.cmscore.apps.CMSEngine.forceShutdown(CMSEngine.java:1968)
at com.netscape.certsrv.apps.CMS.forceShutdown(CMS.java:242)
at com.netscape.cms.logging.LogFile.shutdownCMS(LogFile.java:440)
at com.netscape.cms.logging.LogFile.setupSigningFailure(LogFile.java:682)
at com.netscape.cms.logging.LogFile.setupSigning(LogFile.java:655)
at com.netscape.cms.logging.LogFile.init(LogFile.java:347)
at com.netscape.cmscore.logging.LogSubsystem.init(LogSubsystem.java:126)
... 38 more
[30/May/2018:01:51:30][localhost-startStop-1]: CMS.start(): shutdown server
[30/May/2018:01:51:30][localhost-startStop-1]: CMSEngine.shutdown()
Expected results:
CA should restart successfully.
Additional info:
Isn't this the same thing as this? https://pagure.io/dogtagpki/issue/2481
We never claimed support for ECC signing key for signed audit. It's a feature request by the customer.