freeipa

#9827 Investigate openssl-pkcs12 password length limitation
Opened by rcritten. Modified

Open
Close Issue

Issue

A user reported an issue installing an IPA where it was failing during installation

  [20/33]: requesting RA certificate from CA
  [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n')
CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n')
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

They somehow figured out that this was related to the length of the DM password. Using one shorter than 32 characters allowed them to proceed.

If we can reproduce this then we should not allow passwords longer than 32 and/or ask OpenSSL why there is a limit, or not a bigger one (e.g. 256).

https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/KUPJYJF75DN5OM2PLTT6QIQOTZGPZGPP/

Version/Release/Distribution

Fedora 42 (freeipa-server package 4.12.2-14.fc42)
On alma, OpenSSL is OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)
The freeipa-server package is ipa-server-4.12.2-15.el10.aarch64.rpm

There are a few moving parts here. PKI creates the PKCS#12 file using, I assume JSS. which I assume in turn uses NSS.

Passwords of length <= 63 works. Greater than that and both OpenSSL and NSS fails to unpack the PKI-created PKCS#12 file.

NSS can create PKCS#12 files with passwords greater than 64 characters so I'm not entirely sure what is going on.

But the take-away is we can document/enforce DM passwords < 64.
Metadata
None
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.