freeipa

#9191 ipa vault-add is failing with ipa in RHEL9: ERROR: an internal error has occurred in FIPS mode
Closed: fixed by ftrivino. Opened by ftrivino.

Closed: fixed
Reopen Issue

Description of problem:
'ipa vault-add is failing with ipa: ERROR: An internal error has occurred and
ValueError: Encryption/decryption failed in FIPS Mode.

Version-Release number of selected component (if applicable):

cat /etc/redhat-release

Red Hat Enterprise Linux release 9.1 Beta (Plow)

ipa-server-4.9.8-8.el9.x86_64
package pki-ca is not installed
389-ds-base-2.0.14-1.el9.x86_64
openssl-3.0.1-27.el9_0.x86_64
sssd-ipa-2.6.2-4.el9_0.x86_64
krb5-server-1.19.1-18.el9.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Setup IPA on FIPS enabled machine
2. Add ipa vault

Actual results:
[root@master ~]# ipa vault-add fipsvault --type=standard
ipa: ERROR: non-public: ValueError: Encryption/decryption failed.
Traceback (most recent call last):
File "/usr/lib/python3.9/site-packages/ipalib/backend.py", line 141, in execute
return self.Command_name
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 471, in call
return self.__do_call(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 499, in __do_call
ret = self.run(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 1229, in run
return self.forward(*args, options)
File "/usr/lib/python3.9/site-packages/ipaclient/plugins/vault.py", line 356, in forward
self.api.Command.vault_archive(args, opts)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 471, in call
return self.__do_call(args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 499, in __do_call
ret = self.run(*args, options)
File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 1229, in run
return self.forward(args, options)
File "/usr/lib/python3.9/site-packages/ipaclient/plugins/vault.py", line 990, in forward
return self.internal(algo, transport_cert, args, **options)
File "/usr/lib/python3.9/site-packages/ipaclient/plugins/vault.py", line 735, in internal
result = self._do_internal(algo, transport_cert, False,
File "/usr/lib/python3.9/site-packages/ipaclient/plugins/vault.py", line 712, in _do_internal
wrapped_session_key = public_key.encrypt(
File "/usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 537, in encrypt
return _enc_dec_rsa(self._backend, self, plaintext, padding)
File "/usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 87, in _enc_dec_rsa
return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
File "/usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 151, in _enc_dec_rsa_pkey_ctx
raise ValueError("Encryption/decryption failed.")
ValueError: Encryption/decryption failed.
ipa: ERROR: an internal error has occurred

Support for PKCS#1 v1.5 padding has been recently removed as it will not be allowed in FIPS mode after 2023. None of the FIPS certified modules in RHEL will support it as a FIPS approved mechanism.

vault must be migrated to RSA-OAEP or RSASVE.
Edited by ftrivino

Metadata Update from @ftrivino:
- Issue assigned to ftrivino

Metadata Update from @ftrivino:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6959
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2089907

Metadata Update from @ftrivino:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-12153 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2089907)

master:

  • 2d0a088f93ec27ddb55c82e43c33bcc425a759ef Vault: add support for RSA-OAEP wrapping algo
  • 4cc6b9cd1791e1a5fdbcd8e28904a5856e1f0b41 Vault: improve vault server archival/retrieval calls error handling
  • 305fcc25b4dd0aea4f87a0508c5f47c7634cfb82 kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

ipa-4-11:

  • b1390d1ad7e94256148a6b26431ff1e97fb8b7b3 Vault: add support for RSA-OAEP wrapping algo
  • c6f79e0453c9d417173ca7ecfbd5e233c6a89a9f Vault: improve vault server archival/retrieval calls error handling
  • 601de6985ce0efdd701bfd8361cea72c4b87f39b kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

ipa-4-10:

  • bd71a178bbec2d282e3f146ec1d0e6ee3b1a7cf6 Vault: add support for RSA-OAEP wrapping algo
  • 10643d42ac4d9fc6f843cb5109aa020b19c7eb6c Vault: improve vault server archival/retrieval calls error handling
  • 327b038142a81c7bb61450b34ab58e746308ca6f kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

ipa-4-9:

  • b1fb31fd20c900c9ff1d5d28dfe136439f6bf605 Vault: add support for RSA-OAEP wrapping algo
  • dc1ab53f0aa0398d493f7440b5ec4d70d9c7d663 Vault: improve vault server archival/retrieval calls error handling
  • f2eec9eb208e62f923375b9eaf34fcc491046a0d kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-12153, https://issues.redhat.com/browse/RHEL-12143 (was: https://issues.redhat.com/browse/RHEL-12153)

master:

  • c3d228d4a3c99f8eaf3d9f1d5825fed5cdff5810 Vault: add additional fallback to RSA-OAEP wrapping algo

ipa-4-11:

  • ca561f72d05b937e727db76c42d807ba07661494 Vault: add additional fallback to RSA-OAEP wrapping algo

ipa-4-10:

  • 35507aa7a7dcbfdf9adf0877111034ccb45555b9 Vault: add additional fallback to RSA-OAEP wrapping algo

ipa-4-9:

  • d7c1ba0672fc8964f7674a526f3019429a551372 Vault: add additional fallback to RSA-OAEP wrapping algo

master:

  • cba3094c9af5ceac66dd2c11839acbab80c6e9d3 Support the certmonger nss-user option
  • e6078c639c332e0079fa0cbff3fa54882d79b3bd Don't generate a cafile on HSM instalations
  • 34f28f06db291c7408fbeb7276dcdaae5f0ef18a Add token support to installer certificate handling
  • 73d52a613518ca1e2d2303b660f9dc439987f90f Only generate kracert.p12 when not installing with HSM
  • e3234708ac356065641ce1ea4d6460c7fd50c815 Don't move KRA keys when key backup is disabled
  • f658a264f9cbdb190aa4ff6ab21903da0a7e84c8 doc: Add token-password-file to HSM design, set new OID
  • d9efa728c5c93e232eaf03b432b0699804189012 Add LDAP attribute ipaCaHSMConfiguration to store HSM state
  • 82c0b19acce147b3f82183b561883c7ca9137403 Add HSM configuration options to installer scripts
  • a99091adc0bf8dd745ef3f5980a5bc66294e8c06 Add attribute ipacahsmconfiguration to the "Read CAs" ACI
  • 7ad3b489f6272e5b041d410f8098f454b584209e Update SELinux policy to allow certmonger to PKI config files
  • 93622005ba0f14e68010a84b07cc050cfdc4bedc Add token support to the renew_ca_cert certmonger helper
  • d0c489e28228f4ce5f92c2dfc2c7b9e86c7fcb36 If HSM is configured add the token name to config-show output
  • 0708f603e2d632db77a95d135e28242c6d1a7ee7 renew_ca_cert: skip removing non-CA certs, fix nickname
  • b89aa919778a048fbb54f0a3426423d23f6c38df renew_ca_cert: set peer trust on the KRA audit certificate
  • 06a8791b9beec5a95a5072e9a02a4379ac46770d tests: helper to copy files from one host to another
  • 36dbc6b0258f3e21a3fe6c72cd55bf0c141c0946 ipatests: test software HSM installation with server & replica
  • 6b894f28b5ac07fff3863cc4fec6b9a2383b615e After installing a KRA, copy the updated token to other machines
  • 31d66bac64501efd54afe2041b9d00da66ac0ae3 Validate the HSM token library path and name during installation
  • c6dd21f04e9f14b0c1e5c064e87b3266ff02f60f Remove caSigningCert from list of certs to renew
  • 87ecca0f180fb0cd7ffefb1d9c1b200683a2e38a Add SELinux subpackage for nCipher nfast HSM support
  • f8798b3e16d9f51a3ae355a2270f7346754301dc Add SELinux subpackage for Thales Luna HSM support
  • 1ec875c6fe677357d4dfb50090dc18ae902328a1 ipatests: test software HSM installation with server & replica
  • b63103c88a57b1320ce2e38f7483ef37692feebd tests: Fix failing test test_testconfig.py with missing token variables
  • c6f2d0212bf9aa2ed816779540d69233fe7110a5 dogtag-ipa-ca-renew-agent-submit: expect certs to be on HSMs
  • 31fda79a0e3f34dcf71a9e2687faa958ecb91ab8 Prompt for token password if not provided in replica/ipa-ca-install
  • b9ec2fb0a91034934b48d419c2d0eaa2c36faef1 KRA: force OAEP for some HSM-based installations
  • ea0bf4020ce0b1e32572e128e9323c5af60ec93d After an HSM replica install ensure all certs are visible
  • bcd8d2d90a41eb94422ad5fad730bd0570108f91 Require certmonger 0.79.17+ for required HSM changes
  • 879a937dddf17478378d9e855317ee199ac645c9 Include the HSM tests in the nightlies
  • 6b6c1879c5174869128ae28048673995242b18c1 Call hsm_validator on KRA installs and validate the HSM password
  • c861ce5a1634b43b04c3d38d49d5b3e4e599b7d7 Add SELinux module checking to hsm_validator
  • 6af8577d58c4b2bed04ec0bd02042ba7122ab518 docs: Add a section on SELinux modules to the HSM design

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @rcritten:
- Custom field affects_doc adjusted to on
- Custom field knownissue adjusted to on
- Issue status updated to: Open (was: Closed)

Metadata Update from @ftrivino:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
on
https://github.com/freeipa/freeipa/pull/6959
on
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.