dogtagpki

#3081 Setting FUTURE crypto policy causes pkispawn failure
Closed: migrated by dmoluguw. Opened by ftweedal.

Closed: migrated
Reopen Issue

pkispawn fails during creation of self-signed Server-Cert cert-pki-ca certificate,
due to "insecure algorithm" error from NSS.

This occurs because the key size 2048 bits (e.g. if key size is changed to 3072, it succeeds).

2018-11-29 14:49:23 configuration : INFO     Creating temp SSL server cert for f28-1.ipa.local
2018-11-29 14:49:23 configuration : INFO     Creating password file: /etc/pki/pki-tomcat/pfile
2018-11-29 14:49:23 pkispawn      : INFO     ....... executing 'certutil -S -d /etc/pki/pki-tomcat/alias -n Server-Cert cert-pki-ca -s cn=f28-1.ipa.local,o=2018-11-29 14:49:22 -k rsa -g 2048 -m 0 -v 12 -c cn=f28-1.ipa.local,o=2018-11-29 14:49:22 -t CTu,CTu,CTu -z /etc/pki/pki-tomcat/ca/noise -f /etc/pki/pki-tomcat/pfile -x'
2018-11-29 14:49:23 pkispawn      : ERROR    ....... subprocess.CalledProcessError:  Command '['certutil', '-S', '-d', '/etc/pki/pki-tomcat/alias', '-n', 'Server-Cert cert-pki-ca', '-s', 'cn=f28-1.ipa.local,o=2018-11-29 14:49:22', '-k', 'rsa', '-g', '2048', '-m', '0', '-v', '12', '-c', 'cn=f28-1.ipa.local,o=2018-11-29 14:49:22', '-t', 'CTu,CTu,CTu', '-z', '/etc/pki/pki-tomcat/ca/noise', '-f', '/etc/pki/pki-tomcat/pfile', '-x']' returned non-zero exit status 255.!
2018-11-29 14:49:23 pkispawn      : DEBUG    ....... Error Type: CalledProcessError
2018-11-29 14:49:23 pkispawn      : DEBUG    ....... Error Message: Command '['certutil', '-S', '-d', '/etc/pki/pki-tomcat/alias', '-n', 'Server-Cert cert-pki-ca', '-s', 'cn=f28-1.ipa.local,o=2018-11-29 14:49:22', '-k', 'rsa', '-g', '2048', '-m', '0', '-v', '12', '-c', 'cn=f28-1.ipa.local,o=2018-11-29 14:49:22', '-t', 'CTu,CTu,CTu', '-z', '/etc/pki/pki-tomcat/ca/noise', '-f', '/etc/pki/pki-tomcat/pfile', '-x']' returned non-zero exit status 255.
2018-11-29 14:49:23 pkispawn      : DEBUG    .......   File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 546, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 638, in spawn
    create_temp_sslserver_cert = self.create_temp_sslserver_cert(deployer, instance)
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 472, in create_temp_sslserver_cert
    password_file=deployer.mdict['pki_shared_pfile'])
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/pkihelper.py", line 2617, in generate_self_signed_certificate
    subprocess.check_call(command, stdout=fnull, stderr=fnull)
  File "/usr/lib64/python3.6/subprocess.py", line 291, in check_call
    raise CalledProcessError(retcode, cmd)

The error in the pkispawn log is not helpful, but you can invoke certutil independently to reproduce the error:

The error in the pkispawn log is not helpful, but you can invoke certutil independently to reproduce the error:

[root@f28-1 alias]# certutil -S -d /etc/pki/pki-tomcat/alias \
  -n "Server-Cert cert-pki-ca" \
  -s 'cn=f28-1.ipa.local,o=2018-11-29 14:49:22' -t "CTu,CTu,CTu" \
  -c "cn=f28-1.ipa.local,o=2018-11-29 14:49:22" \
  -z /etc/pki/pki-tomcat/ca/noise -f /etc/pki/pki-tomcat/pfile -x \
  -k rsa -g 4096 -m 0 -v 12
Generating key.  This may take a few moments...
certutil: bad certificate request
: SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED: The certificate was signed using a signature algorithm that is disabled because it is not secure.                                                                  
certutil: unable to create cert (The certificate was signed using a signature algorithm that is disabled because it is not secure.)

Possible ways to fix this:
1. switch to 3072 bit key; trivial and no significant downside
2. create a temporary CA with big-enough key, use that key so sign the temporary Server-Cert, and delete the temporary CA when no longer needed. Conservative approach, but complex.

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/3198

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata Update from @dmoluguw:
- Issue close_status updated to: migrated
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.