RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1859495 - dnf doesn't work with pkcs11 client certificate and key
Summary: dnf doesn't work with pkcs11 client certificate and key
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: librepo
Version: 8.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: 8.0
Assignee: Lukáš Hrázký
QA Contact: Eva Mrakova
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-07-22 09:40 UTC by Masahiro Matsuya
Modified: 2021-05-18 15:07 UTC (History)
7 users (show)

Fixed In Version: librepo-1.12.0-3.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-18 15:07:42 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:1689 0 None None None 2021-05-18 15:07:46 UTC

Description Masahiro Matsuya 2020-07-22 09:40:41 UTC 
Description of problem:
dnf doesn't work with pkcs11 client certificate and key.
pkcs11 client certificate was specified in yum configuration as below.

  sslclientcert="pkcs11:....."
  sslclientkey="pkcs11:....."

But, it failed with an error:

could not load PEM client certificate, OpenSSL error error:02001002:system library:fopen:No such file or directory, (no key found, wrong pass phrase, or wrong file format?)

It worked with curl command with specifying the pkcs11 cert and key.
I found that curl command checks the heading string "pkcs11:" before calling curl_easy_perform(), and set CURLOPT_SSLCERTTYPE and CURLOPT_SSLKEYTYPE as "ENG". As a result, curl could get the pkcs11 certificate via Engine.

In the case of DNF, I thought librepo should do the same thing.

I created a patch and I (and the customer) confirmed that the problem was gone with it.

I will attach the patch.

Version-Release number of selected component (if applicable):
RHEL8.2
librepo-1.11.0-2.el8.x86_64.rpm  

How reproducible:
Always

Steps to Reproduce:
1. prepare the pkcs11 environment.
2. register and attach a subscription with subscription-manager.
3. import the client certificate and key in /etc/pki/entitlement into pkcs11 data store.
4. use subscription-manager repo-override for modifying the repository configuration.

# subscription-manager repo-override --repo=rhel-8-for-x86_64-baseos-rpms --add=sslclientcert:"pkcs11:...."
# subscription-manager repo-override --repo=rhel-8-for-x86_64-baseos-rpms --add=sslclientkey:"pkcs11:...."

NOTE: modifying /etc/yum.repos.d/redhat.repo directly doesn't work. It's recreated in every dnf/yum command runs.

5. run dnf command to install from any package in rhel-8-for-x86_64-baseos-rpms

Otherwise, build a httpd with TLS enabled requiring the client certificate

Actual results:
dnf doesn't work with pkcs11 certificate and key.

Expected results:
dnf can work with pkcs11 certificate and key.

Additional info:
Comment 7 Lukáš Hrázký 2020-11-18 14:29:05 UTC 
Thank you very much, Masahiro, I was able to reproduce the issue easily and I appreciate the time you've put into such a thorough explanation.

I've verified the solution and created a pull request, putting you as the author (I only added the block scope curly brackets):
https://github.com/rpm-software-management/librepo/pull/215
Comment 13 Lukáš Hrázký 2021-03-10 13:33:38 UTC 
Mike, your issue is most likely unrelated, please check the bug description, it is just describing a whole different case AFAICS.

There's no incentive to backport Masahiro's patch to RHEL 7, as it is basically adding new functionality.

I don't know off the top of my head, but it seems to me you're simply missing the certificate for your mirror and you need to fix that. Unlikely a bug in yum. Since I see pulp in the URL, maybe the Pulp people can help you with this specific case.
Comment 16 Mike Cao 2021-03-11 01:57:55 UTC 
(In reply to Lukáš Hrázký from comment #13)
> Mike, your issue is most likely unrelated, please check the bug description,
> it is just describing a whole different case AFAICS.
> 
> There's no incentive to backport Masahiro's patch to RHEL 7, as it is
> basically adding new functionality.
> 
> I don't know off the top of my head, but it seems to me you're simply
> missing the certificate for your mirror and you need to fix that. Unlikely a
> bug in yum. Since I see pulp in the URL, maybe the Pulp people can help you
> with this specific case.


Sorry. I missed 2 lines in copy&paste. 
Here is the repo used during RHEL7 upgrade to RHEL8

[rhui-rhel-8-for-x86_64-baseos-rhui-rpms]
name=Red Hat Enterprise Linux 8 for x86_64 - BaseOS from RHUI (RPMs)
mirrorlist=<customer mirror link>
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release1
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle1.crt
sslclientcert=/etc/pki/rhui/product/content1.crt
sslclientkey=/etc/pki/rhui/key1.pem
Comment 20 errata-xmlrpc 2021-05-18 15:07:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (librepo bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1689
Note You need to log in before you can comment on or make changes to this bug.