freeipa

#7677 HSM: ipa ca-add fails with error in ipa-pki-retrieve-key
Closed: fixed by rcritten. Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

The ipa-pki-retrieve-key helper does not yet know how to handle a Dogtag installation with HSM.

Steps to Reproduce

  1. Install Dogtag with NitroHSM integration (requires additional patches and configuration)
  2. ipa ca-add

Actual behavior

Command fails:

# ipa ca-add --subject="CN=testca1" testca1
ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500

Dogtag debug logs:

2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: CertificateAuthority: size: 911 bytes
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: CertificateAuthority: subject DN: CN=Certificate Authority,O=HSM.EXAMPLE
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: CertificateAuthority: issuer DN: CN=Certificate Authority,O=HSM.EXAMPLE
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: CA SigningUnit.init(ca, ca.signing, UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c31-43c8-ba5c-8c63860e374a)
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: Setting ca.signing.newNickname=UserPIN (SmartCard-HSM):UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c31-43c8-b
a5c-8c63860e374a
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: SigningUnit: Loading certificate UserPIN (SmartCard-HSM):UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c31-43c8
-ba5c-8c63860e374a
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: SigningUnit: Unable to find certificate UserPIN (SmartCard-HSM):UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c
31-43c8-ba5c-8c63860e374a
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] WARNING: CA signing key and cert not (yet) present in NSSDB
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: Starting KeyRetrieverRunner thread
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: CertificateAuthority init: initRequestQueue
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: In LdapBoundConnFactory::getConn()
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: masterConn is connected: true
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: getConn: conn is connected true
2018-08-22 11:51:37 [ajp-nio-127.0.0.1-8009-exec-2] FINE: getConn: mNumConns now 1
2018-08-22 11:51:37 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Running ExternalProcessKeyRetriever
2018-08-22 11:51:37 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c31-43c8-ba5c-8c63860e374a, master.hsm.example]
...
2018-08-22 11:51:41 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Failed to retrieve key from any host.
2018-08-22 11:51:41 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] WARNING: KeyRetriever did not return a result.
2018-08-22 11:51:41 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Retrying in 10 seconds
2018-08-22 11:51:51 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Running ExternalProcessKeyRetriever
2018-08-22 11:51:51 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, UserPIN (SmartCard-HSM):caSigningCert cert-pki-ca 89e791bd-6c31-43c8-ba5c-8c63860e374a, master.hsm.example]
2018-08-22 11:51:55 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Failed to retrieve key from any host.
2018-08-22 11:51:55 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] WARNING: KeyRetriever did not return a result.
2018-08-22 11:51:55 [KeyRetrieverRunner-89e791bd-6c31-43c8-ba5c-8c63860e374a] FINE: Retrying in 15 seconds

master:

  • 17c2e31fdc77183b49edc728cc775c4078bf782e Don't move keys when key backup is disabled

ipa-4-8:

  • f6c2a9de8c82d86ea3af8fed794e4e0865023ae0 Don't move keys when key backup is disabled

Metadata Update from @rcritten:
- Issue tagged with: hsm

I think a lot has change in the interim. The ca-add is successful but does not store the subca onto the HSM device. The NSS naming suggests that it may have tried to do the right thing. From the certutil output:

NSS Certificate DB:softhsm_token:caSigningCert cert-pki-ca c2c8a21b-21d7-4919-8ba2-9316b6ca61a5 u,u,u

The HSM (softhsm2) has no orphaned keys.

Based on the pki log I think that the token is being added to the nickname:

2022-08-29 19:27:08 [KeyRetrieverRunner-c2c8a21b-21d7-4919-8ba2-9316b6ca61a5] INFO: ExternalProcessKeyRetriever: Retrieving softhsm_token:caSigningCert cert-pki-ca c2c8a21b-21d7-4919-8ba2-9316b6ca61a5 ke

master:

  • cba3094c9af5ceac66dd2c11839acbab80c6e9d3 Support the certmonger nss-user option
  • e6078c639c332e0079fa0cbff3fa54882d79b3bd Don't generate a cafile on HSM instalations
  • 34f28f06db291c7408fbeb7276dcdaae5f0ef18a Add token support to installer certificate handling
  • 73d52a613518ca1e2d2303b660f9dc439987f90f Only generate kracert.p12 when not installing with HSM
  • e3234708ac356065641ce1ea4d6460c7fd50c815 Don't move KRA keys when key backup is disabled
  • f658a264f9cbdb190aa4ff6ab21903da0a7e84c8 doc: Add token-password-file to HSM design, set new OID
  • d9efa728c5c93e232eaf03b432b0699804189012 Add LDAP attribute ipaCaHSMConfiguration to store HSM state
  • 82c0b19acce147b3f82183b561883c7ca9137403 Add HSM configuration options to installer scripts
  • a99091adc0bf8dd745ef3f5980a5bc66294e8c06 Add attribute ipacahsmconfiguration to the "Read CAs" ACI
  • 7ad3b489f6272e5b041d410f8098f454b584209e Update SELinux policy to allow certmonger to PKI config files
  • 93622005ba0f14e68010a84b07cc050cfdc4bedc Add token support to the renew_ca_cert certmonger helper
  • d0c489e28228f4ce5f92c2dfc2c7b9e86c7fcb36 If HSM is configured add the token name to config-show output
  • 0708f603e2d632db77a95d135e28242c6d1a7ee7 renew_ca_cert: skip removing non-CA certs, fix nickname
  • b89aa919778a048fbb54f0a3426423d23f6c38df renew_ca_cert: set peer trust on the KRA audit certificate
  • 06a8791b9beec5a95a5072e9a02a4379ac46770d tests: helper to copy files from one host to another
  • 36dbc6b0258f3e21a3fe6c72cd55bf0c141c0946 ipatests: test software HSM installation with server & replica
  • 6b894f28b5ac07fff3863cc4fec6b9a2383b615e After installing a KRA, copy the updated token to other machines
  • 31d66bac64501efd54afe2041b9d00da66ac0ae3 Validate the HSM token library path and name during installation
  • c6dd21f04e9f14b0c1e5c064e87b3266ff02f60f Remove caSigningCert from list of certs to renew
  • 87ecca0f180fb0cd7ffefb1d9c1b200683a2e38a Add SELinux subpackage for nCipher nfast HSM support
  • f8798b3e16d9f51a3ae355a2270f7346754301dc Add SELinux subpackage for Thales Luna HSM support
  • 1ec875c6fe677357d4dfb50090dc18ae902328a1 ipatests: test software HSM installation with server & replica
  • b63103c88a57b1320ce2e38f7483ef37692feebd tests: Fix failing test test_testconfig.py with missing token variables
  • c6f2d0212bf9aa2ed816779540d69233fe7110a5 dogtag-ipa-ca-renew-agent-submit: expect certs to be on HSMs
  • 31fda79a0e3f34dcf71a9e2687faa958ecb91ab8 Prompt for token password if not provided in replica/ipa-ca-install
  • b9ec2fb0a91034934b48d419c2d0eaa2c36faef1 KRA: force OAEP for some HSM-based installations
  • ea0bf4020ce0b1e32572e128e9323c5af60ec93d After an HSM replica install ensure all certs are visible
  • bcd8d2d90a41eb94422ad5fad730bd0570108f91 Require certmonger 0.79.17+ for required HSM changes
  • 879a937dddf17478378d9e855317ee199ac645c9 Include the HSM tests in the nightlies
  • 6b6c1879c5174869128ae28048673995242b18c1 Call hsm_validator on KRA installs and validate the HSM password
  • c861ce5a1634b43b04c3d38d49d5b3e4e599b7d7 Add SELinux module checking to hsm_validator
  • 6af8577d58c4b2bed04ec0bd02042ba7122ab518 docs: Add a section on SELinux modules to the HSM design

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

hsm

None
None
High
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.