freeipa

#9785 IPA fails to sign zone in FIPS mode
Opened by frenaud. Modified

Open
Close Issue

Issue

On fedora 42 in FIPS mode, IPA fails to sign a zone.

Steps to Reproduce

  1. Prepare a Fedora 42 machine in FIPS mode with selinux permissive mode
  2. Install IPA server from the nightly builds: dnf copr enable -y @freeipa/freeipa-master-nightly; dnf install -y freeipa-server-dns; ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  3. Enable the machine as DNSSEC master: ipa-dns-install --dnssec-master --forwarder 10.11.5.160 -U
  4. Add a new DNSSEC-enabled zone: kinit admin; ipa dnszone-add dnssec.test --skip-overlap-check --dnssec true --ttl 1 --default-ttl 1

Actual behavior

The new zone is added but the records are not signed.

Expected behavior

The records should be signed.

Version/Release/Distribution

freeipa-server-4.13.0.dev202505121115+git-0.fc42.x86_64
bind-9.18.36-1.fc42.x86_64
bind-dyndb-ldap-11.11-4.fc42.x86_64
softhsm-2.6.1-11.fc42.x86_64
crypto-policies-20250214-1.gitff7551b.fc42.noarch
openssl-3.2.4-3.fc42.x86_64

Additional info:

The zone is added by IPA: httpd/error_log

[Tue May 13 05:34:53.180316 2025] [wsgi:error] [pid 59147:tid 59679] [remote 10.0.187.109:60774] ipa: INFO: [jsonserver_kerb] admin@IPA.TEST: dnszone_add/1('dnssec.test', dnsttl=1, dnsdefaultttl=1, idnssecinlinesigning=True, skip_overlap_check=True, version='2.254'): SUCCESS

The journal shows an error when calling /usr/sbin/dnssec-keyfromlabel:

May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: INFO: The XML in /etc/opendnssec/zonelist.xml.new is valid
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [zonelist_export_cmd] zonelist exported to /etc/opendnssec/zonelist.xml successfully
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.odsmgr: INFO     Zones removed from LDAP: []
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.odsmgr: INFO     Zones added to LDAP: [('6c50d501-2fdd-11f0-b1d4-dccc94634197', <DNS name dnssec.test.>)]
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [zone_add_cmd] WARNING: The input file /var/lib/ipa/dns/zone/entryUUID/6c50d501-2fdd-11f0-b1d4-dccc94634197 for zone dnssec.test does not currently exist. The zone will be added to the database anyway.
May 13 05:34:53 server.ipa.test named[59837]: zone dnssec.test/IN (signed): loaded serial 1747128894
May 13 05:34:53 server.ipa.test named[59837]: zone dnssec.test/IN (signed): receive_secure_serial: unchanged
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [zone_add_cmd] zone dnssec.test added [policy: default]
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: INFO: The XML in /var/opendnssec/enforcer/zones.xml.update is valid
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [zone_add_cmd] internal zonelist updated successfully
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: 1 zone(s) found on policy "default"
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [hsm_key_factory_generate] 1 keys needed for 1 zones covering 31536000 seconds, generating 1 keys for policy default
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: 1 new KSK(s) (3072 bits) need to be created.
May 13 05:34:53 server.ipa.test /mod_wsgi[59147]: [🡕] [IPA.API] admin@IPA.TEST: dnszone_add: SUCCESS [ldap2_139923644839120] {"idnsname": {"__dns_name__": "dnssec.test."}, "idnssoarname": {"__dns_name__": "hostmaster"}, "idnssoarefresh": 3600, "idnssoaretry": 900, "idnssoaexpire": 1209600, "idnssoaminimum": 3600, "dnsttl": 1, "dnsdefaultttl": 1, "idnsupdatepolicy": "grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA; grant IPA.TEST krb5-self * SSHFP;", "idnsallowdynupdate": false, "idnsallowquery": "any;", "idnsallowtransfer": "none;", "idnssecinlinesigning": true, "skip_overlap_check": true, "force": false, "skip_nameserver_check": false, "all": false, "raw": false, "version": "2.254"}
May 13 05:34:53 server.ipa.test named[59837]: zone dnssec.test/IN (signed): could not get zone keys for secure dynamic update
May 13 05:34:53 server.ipa.test named[59837]: zone dnssec.test/IN (signed): serial 1747128895 (unsigned 1747128895)
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: 1 zone(s) found on policy "default"
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [hsm_key_factory_generate] 5 keys needed for 1 zones covering 31536000 seconds, generating 5 keys for policy default
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: 5 new ZSK(s) (2048 bits) need to be created.
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [enforcer] update zone: dnssec.test
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.odsmgr: INFO     input is set to /var/lib/ipa/dns/zone/entryUUID/6c50d501-2fdd-11f0-b1d4-dccc94634197.
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: output is set to /var/opendnssec/signed/dnssec.test.
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: Zone dnssec.test added successfully
May 13 05:34:53 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.odsmgr: INFO     All tasks scheduled immediately.
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [signconf_cmd] performing signconf for zone dnssec.test
May 13 05:34:53 server.ipa.test ods-enforcerd[59694]: [signconf_cmd] signconf done for zone dnssec.test, notifying signer
May 13 05:34:53 server.ipa.test systemd[1]: Started ipa-ods-exporter.service - IPA OpenDNSSEC Signer replacement.
May 13 05:34:53 server.ipa.test audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-ods-exporter comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 13 05:34:54 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     To increase debugging set debug=True in dns.conf See default.conf(5) for details
May 13 05:34:54 server.ipa.test python3[59925]: GSSAPI client step 1
May 13 05:34:54 server.ipa.test python3[59925]: GSSAPI client step 1
May 13 05:34:54 server.ipa.test python3[59925]: GSSAPI client step 1
May 13 05:34:54 server.ipa.test python3[59925]: Configuration.cpp(96): Missing log.level in configuration. Using default value: INFO
May 13 05:34:54 server.ipa.test python3[59925]: Configuration.cpp(96): Missing slots.mechanisms in configuration. Using default value: ALL
May 13 05:34:54 server.ipa.test python3[59925]: Configuration.cpp(124): Missing slots.removable in configuration. Using default value: false
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     new replica keys in LDAP: set()
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     obsolete replica keys in local HSM: set()
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     ldap2master_replica: keys in local HSM & LDAP: {'0x2d3126c6f130ae90a739dfdac9d1aede'}
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     master2ldap_zone_keys: keys in local HSM & LDAP: set()
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     master2ldap_zone_keys: keys in local HSM & LDAP: set()
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     dnssec.test: new key metadata from ODS: {'ZSK-20250513093453Z-ad3dd8ad9f12e33cf9617f6fd35f41ca', 'KSK-20250513093453Z-d172396a861a9d70e233a9955aa3c1c3'}
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.bindmgr: INFO     Key metadata cn=ZSK-20250513093453Z-ad3dd8ad9f12e33cf9617f6fd35f41ca,cn=keys,idnsname=dnssec.test.,cn=dns,dc=ipa,dc=test added to zone dnssec.test.
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]: ipaserver.dnssec.bindmgr: INFO     Synchronizing zone dnssec.test.
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     dnssec.test: deleted key metadata in LDAP: set()
May 13 05:34:55 server.ipa.test ipa-ods-exporter[59925]: ipa-ods-exporter: INFO     dnssec.test: key metadata in LDAP & ODS: set()
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: 1 zone(s) found on policy "default"
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: [hsm_key_factory_generate] 5 keys needed for 1 zones covering 31536000 seconds, generating 1 keys for policy default
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: 1 new ZSK(s) (2048 bits) need to be created.
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]: Traceback (most recent call last):
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/libexec/ipa/ipa-dnskeysyncd", line 130, in <module>
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     while ldap_connection.syncrepl_poll(all=1, msgid=ldap_search):
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib64/python3.13/site-packages/ldap/syncrepl.py", line 435, in syncrepl_poll
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.syncrepl_entry(dn, attrs, c.entryUUID)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/syncrepl.py", line 70, in syncrepl_entry
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.application_add(uuid, dn, attributes)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/keysyncer.py", line 84, in application_add
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.key_meta_add(uuid, dn, attributes)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/keysyncer.py", line 137, in key_meta_add
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.bindmgr_sync(self.dnssec_zones)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/keysyncer.py", line 150, in bindmgr_sync
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.bindmgr.sync(dnssec_zones)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/bindmgr.py", line 241, in sync
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.sync_zone(zone)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/bindmgr.py", line 214, in sync_zone
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     self.install_key(zone, uuid, attrs, tempdir)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipaserver/dnssec/bindmgr.py", line 155, in install_key
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     result = ipautil.run(cmd, capture_output=True)
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:   File "/usr/lib/python3.13/site-packages/ipapython/ipautil.py", line 607, in run
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     raise CalledProcessError(
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:         p.returncode, arg_string, output_log, error_log
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]:     )
May 13 05:34:55 server.ipa.test ipa-dnskeysyncd[59827]: ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/sbin/dnssec-keyfromlabel', '-K', '/var/named/dyndb-ldap/ipa/master/dnssec.test/tmp88vdszw2', '-a', 'RSASHA256', '-l', 'pkcs11:object=ad3dd8ad9f12e33cf9617f6fd35f41ca;token=ipaDNSSEC', '-P', '20250513093453', '-A', 'none', '-I', 'none', '-D', 'none', 'dnssec.test.'] returned non-zero exit status 1: 'dnssec-keyfromlabel: warning: OSSL_STORE_open_ex failed (crypto failure)\ndnssec-keyfromlabel: fatal: failed to get key dnssec.test/RSASHA256: crypto failure\n')
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: 1 zone(s) found on policy "default"
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: [hsm_key_factory_generate] 1 keys needed for 1 zones covering 31536000 seconds, generating 1 keys for policy default
May 13 05:34:55 server.ipa.test ods-enforcerd[59694]: 1 new KSK(s) (3072 bits) need to be created.
May 13 05:34:55 server.ipa.test systemd[1]: ipa-ods-exporter.service: Deactivated successfully.
May 13 05:34:55 server.ipa.test audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-ods-exporter comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 13 05:34:55 server.ipa.test systemd[1]: ipa-ods-exporter.service: Consumed 1.462s CPU time, 75.1M memory peak.
May 13 05:34:55 server.ipa.test systemd[1]: ipa-dnskeysyncd.service: Main process exited, code=exited, status=1/FAILURE
May 13 05:34:55 server.ipa.test systemd[1]: ipa-dnskeysyncd.service: Failed with result 'exit-code'.
May 13 05:34:55 server.ipa.test audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-dnskeysyncd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
May 13 05:34:55 server.ipa.test systemd[1]: ipa-dnskeysyncd.service: Consumed 1.435s CPU time, 71.4M memory peak.

Note the error: ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/sbin/dnssec-keyfromlabel', '-K', '/var/named/dyndb-ldap/ipa/master/dnssec.test/tmp88vdszw2', '-a', 'RSASHA256', '-l', 'pkcs11:object=ad3dd8ad9f12e33cf9617f6fd35f41ca;token=ipaDNSSEC', '-P', '20250513093453', '-A', 'none', '-I', 'none', '-D', 'none', 'dnssec.test.'] returned non-zero exit status 1: 'dnssec-keyfromlabel: warning: OSSL_STORE_open_ex failed (crypto failure)\ndnssec-keyfromlabel: fatal: failed to get key dnssec.test/RSASHA256: crypto failure\n')

@simo @dbelyavs we call OSSL_STORE_open("pkcs11:object=ad3dd8ad9f12e33cf9617f6fd35f41ca;token=ipaDNSSEC", NULL, NULL, ...) in FIPS mode and it fails. Do you think it may be something wrong in pkcs11-provider?
Edited by abbra

@simo could you please check that the store has fips=yes property? If not, it wouldn't work in FIPS mode. If yes, it would be my problem

Looks like https://github.com/latchset/pkcs11-provider/issues/164 is still not solved and we need to add pkcs11-module-assume-fips = true in the openssl config for the pkcs11_bind_sect

$ git grep pkcs11_bind_sect
install/share/bind.openssl.provider.cnf.template:pkcs11 = pkcs11_bind_sect
install/share/bind.openssl.provider.cnf.template:[pkcs11_bind_sect]
install/share/bind.openssl.provider.crp.cnf.template:pkcs11 = pkcs11_bind_sect
install/share/bind.openssl.provider.crp.cnf.template:[pkcs11_bind_sect]

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-113421

master:

  • 3e6b5b954b355df3f4f0859961f1a5ae151d72f5 FIPS mode: openssl pkcs12 command needs -nomacver option
  • ca5510a08dd5e8bdad617589a3acf1aee427373a ipatests: mark test_dnssec as xfail in fips mode
  • bcbc88dc4a77d159ffcfa8ca4d2d98ef90f089d6 temp_commit: revert to the version pre 0b521f7

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Reopening, as the above patch (ca5510a ipatests: mark test_dnssec as xfail in fips mode) only marks the test as xfail - it doesn't provide a fix for the product issue

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)
Metadata
None

fips test-failure

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.