attrcrypt_unwrap_key: failed to unwrap key for cipher AES

[Chun Tat David Chu]

Hi All,

Occasionally I see the following messages when I start the 389DS.

<timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher AES
<timestamp> Failed to retrieve key for cipher AES in attrcrypt_cipher_init
<timestamp> Failed to initialize cipher AES in attrcrypt_init
<timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher 3DES
<timestamp> Failed to retrieve key for cipher 3DES in attrcrypt_cipher_init
<timestamp> Failed to initialize cipher 3DES in attrcrypt_init

Can someone tell me what went wrong there?  It looks like these messages are
harmless because 389DS still started up successfully and able to process all
requests.

Thanks,

- David

[Rich Megginson]

On 12/16/2010 03:41 PM, Chun Tat David Chu wrote:
> Hi All,
>
> Occasionally I see the following messages when I start the 389DS.
>
> <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher AES
> <timestamp> Failed to retrieve key for cipher AES in attrcrypt_cipher_init
> <timestamp> Failed to initialize cipher AES in attrcrypt_init
> <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher 3DES
> <timestamp> Failed to retrieve key for cipher 3DES in 
> attrcrypt_cipher_init
> <timestamp> Failed to initialize cipher 3DES in attrcrypt_init
>
> Can someone tell me what went wrong there?  It looks like these 
> messages are harmless because 389DS still started up successfully and 
> able to process all requests.

Yes, it should be harmless unless you are actually using attribute 
encryption.
> Thanks,
> David
>
> --
> 389 users mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/389-users

[Chun Tat David Chu]

Hi Rich,

Can you tell me what triggers this message?

Thanks,

David

2010/12/17 Rich Megginson
> On 12/16/2010 03:41 PM, Chun Tat David Chu wrote:
>
> Hi All,
>
> Occasionally I see the following messages when I start the 389DS.
>
> <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher AES
> <timestamp> Failed to retrieve key for cipher AES in attrcrypt_cipher_init
> <timestamp> Failed to initialize cipher AES in attrcrypt_init
> <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher 3DES
> <timestamp> Failed to retrieve key for cipher 3DES in attrcrypt_cipher_init
> <timestamp> Failed to initialize cipher 3DES in attrcrypt_init
>
> Can someone tell me what went wrong there?  It looks like these messages
> are harmless because 389DS still started up successfully and able to process
> all requests.
>
> Yes, it should be harmless unless you are actually using attribute
> encryption.
>
> Thanks,
> David
>
> --
> 389 users mailing [e-mail]://admin.fedoraproject.org/mailman/listinfo/389-users
>
> --
> 389 users mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/389-users

[remy d1]

Hi Chun,

I had the same problem. I think you tried to install 389-DS with SSL but
your certificates were not loaded by 389-DS (389-ds know that you configured
SSL but he can not load the certificates (perhaps your certificate autority
is not good);

I think you should read this :
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Administ...

Or try to migrate in ssl again and generate new certificates with CA.

Regards;

2010/12/20 Chun Tat David Chu
> Hi Rich,
>
> Can you tell me what triggers this message?
>
> Thanks,
>
> David
>
> 2010/12/17 Rich Megginson
>
> On 12/16/2010 03:41 PM, Chun Tat David Chu wrote:
> > Hi All,
> >
> > Occasionally I see the following messages when I start the 389DS.
> >
> > <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher AES
> > <timestamp> Failed to retrieve key for cipher AES in attrcrypt_cipher_init
> > <timestamp> Failed to initialize cipher AES in attrcrypt_init
> > <timestamp> attrcrypt_unwrap_key:  failed to unwrap key for cipher 3DES
> > <timestamp> Failed to retrieve key for cipher 3DES in
> > attrcrypt_cipher_init
> > <timestamp> Failed to initialize cipher 3DES in attrcrypt_init
> >
> > Can someone tell me what went wrong there?  It looks like these messages
> > are harmless because 389DS still started up successfully and able to process
> > all requests.
> >
> > Yes, it should be harmless unless you are actually using attribute
> > encryption.
> >
> > Thanks,
> > David
> >
> > --
> > 389 users mailing [e-mail]://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> > --
> > 389 users mailing list
> > [e-mail]
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
> --
> 389 users mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/389-users