Bug 1857933
| Summary: | CA Installation is failing with ncipher v12.30 HSM | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Pritam Singh <prisingh> |
| Component: | pki-core | Assignee: | Alex Scheel <ascheel> |
| Status: | CLOSED ERRATA | QA Contact: | PKI QE <bugzilla-pkiqe> |
| Severity: | medium | Docs Contact: | Florian Delehaye <fdelehay> |
| Priority: | urgent | ||
| Version: | 8.3 | CC: | aakkiang, ascheel, cfu, edewata, fdelehay, jmagne, lmanasko, lmcgarry, lmiksik |
| Target Milestone: | rc | Keywords: | Regression, TestBlocker, TestCaseProvided |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pki-core-10.6-8030020200818221307.5ff1562f | Doc Type: | Known Issue |
| Doc Text: |
.`pki-core` fails when `sslserver` certificates reside on the HSM
`pki-core` now requires exporting the subsystem SSL certificate chain from the Network Security Services (NSS) database of the PKI instance, however the automatic export does not correctly handle token name qualifications for the `sslserver` certificate nickname.
Therefore, if the certificates reside on the HSM, the NSS database is not opened using the specified HSM token and the export fails.
As a consequence, installing PKI instances and using existing PKI instances fails with HSM-backed `sslserver` certificates.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 03:15:45 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1842946 | ||
|
Comment 8
Pritam Singh
2020-07-20 16:59:51 UTC
This is the correct commit information. Sorry for the noise! > Commit information: > =================== commit 0c41ac72c47f34b3dc1293768e656a03d3d283b5 Author: Alexander Scheel <ascheel> Date: Tue Jul 21 16:09:44 2020 -0400 Support exporting CA certificate from HSM installs When installing an installation with subsystem SSL certificate residing on the HSM, export will fail because the NSS DB isn't opened with the specified HSM token. When the subsystem SSL certificate resides on the HSM, when we go to export the CA certificate, we must explicitly specify this token. Otherwise, subsystem startup will fail with an error like: systemd[1]: Starting PKI Tomcat Server topology-02-CA... pki-server[72759]: Enter password for NHSM6000-OCS pki-server[72759]: ERROR: Certificate not found: NHSM6000-OCS:Server-Cert cert-topology-02-CA pki-server[72759]: ERROR: Command: pki -d /etc/pki/topology-02-CA/alias -C /tmp/tmpptxlpn4k/password.txt pkcs12-export --pkcs12 /tmp/tmp1idfd1am/sslserver.p12 --password-file /tmp/tmpc5y2bhjo/password.txt --no-key NHSM6000-OCS:Server-Cert cert-topology-02-CA systemd[1]: pki-tomcatd: Control process exited, code=exited status=255 systemd[1]: pki-tomcatd: Failed with result 'exit-code'. This is related to the earlier PR enforcing certificate verification in PKIConnection, pr-#443. Resolves: rh-bz#1857933 Signed-off-by: Alexander Scheel <ascheel> Fixed in master branch (PKI 10.10): * https://github.com/dogtagpki/pki/commit/d7858a3b3082dcebc7652a7b10193e47d3f95bd5 * https://github.com/dogtagpki/pki/commit/c5e1541fe044e147d442400368ac55debc16dfd9 * https://github.com/dogtagpki/pki/commit/04c78d6227cd5c8cb497dbc3bf1b57d1de8e70dc * https://github.com/dogtagpki/pki/commit/2de8e580b860675f0d37005ace082c21b95ee213 Fixed in v10.9 branch: * https://github.com/dogtagpki/pki/commit/a48e731d0faab11929fd9bf3d54a0638bbf40a16 * https://github.com/dogtagpki/pki/commit/0c6b6e916420faa583a25a12621100a35bba1b57 * https://github.com/dogtagpki/pki/commit/2df13c4195e8e6b184294888b2c6376043047e33 * https://github.com/dogtagpki/pki/commit/eb28b09fb030fe5df2b6b4cfa16338ddd0325b30 *** Bug 1847312 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:4847 |