This error is due to the fact the KDC used in this setup is running on RHEL 8.5. Hence, it hasn't been patched to use SHA-2 for CMS signature instead (SHA-1 signature verification being blocked by DEFAULT crypto-policy on RHEL9).

We thought the SHA-1 issue was affecting anonymous PKINIT only but this error, and the further tests I did with certificate files and softhsm2 virtual smartcards are showing this actually affects all use cases of PKINIT.

The fix we provided for bug 2066316 resolves this issue too, but we should make clear in the documentation and release notes that in case a RHEL9 Kerberos agent interacts with another non-patched agent (regardless of which one is client or KDC) one of the following action should be taken:

* Set RHEL9 agent's crypto-policy to DEFAULT:SHA1 (to allow verification of SHA-1 signatures)
* Update the non-RHEL9 agent to be sure it won't sign CMS messages using SHA-1. Here are versions providing this fix:
    * RHEL 9    krb5-1.19.1-15
    * RHEL 8.7  krb5-1.18.2-17
    * RHEL 7.9  krb5-1.15.1-53
    * Fedora 36/Rawhide krb5-1.19.2-7
    * Fedora 35/34      krb5-1.19.2-3

The main reason why this fix has to be applied on all agents it that the current implementation for CMS signature does not pick the best possible digest cipher for the key being, used similarly to what Heimdal is doing[1]. In MIT krb5, the digest algorithm is hard-coded[2] making the switch difficult, especially when the algorithm in question is deprecated and even blocked in some environments (in the present case RHEL9).

What we can do at this point to keep such issues to happen again in the future, is to implement proper algorithm deduction based on source agent information provided. In the case of CMS data, using the "supportedCMSTypes" attribute, which was introduced in RFC8636[3] attribute. This incomplete implementation was already reported to cause integration issues with Heimdal in bug 2068935.

[1] https://github.com/heimdal/heimdal/blob/master/lib/hx509/crypto.c#L2646-L2649
[2] https://github.com/krb5/krb5/blob/krb5-1.19.3-final/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c#L1230
[3] https://datatracker.ietf.org/doc/html/rfc8636.html#page-10

This ticket is actually a RFE: for PKINIT CMS data digest, MIT krb5 always uses SHA-256. Infer the digest algorithm from the "supportedCMSTypes" attribute would simplify integration with other Kerberos clients and servers, and avoid the necessity to explicitly upgrade to a stronger algorithm in the future.

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.