11:10 a.m.
On ti, 28 touko 2019, Rob Crittenden via FreeIPA-users wrote:
チョーチュアン via FreeIPA-users wrote:
> Hello,
>
> Recently I've been experimenting on HSM with FreeIPA, I got stuck at the
> CA generation, but it's a separate issue. I somehow achieve a successful
> key generation on HSM with default key_algorimth/size/ settings. RSA
> 3072/2048 keys showed up on the HSM even after a failed CA installation
> but not the case with ECC keys.
>
> The error was:
> Failed to configure CA instance: CalledProcessError(Command
> ['/usr/sbin/pkispawn', '-s', 'CA', '-f',
'/tmp/tmp877ip58a'] returned
> non-zero exit status 1:
>
> pkihelper : ERROR Server unreachable due to SSL error:
> [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE]
>
> sslv3 alert handshake failure (_ssl.c:1056)
>
> configuration : ERROR Server failed to restart
> pkispawn : ERROR Exception: server failed to restart
>
> File "/usr/lib/python3.7/site-packages/pki/server/pkispawn.py", line
> 547, in main
> scriptlet.spawn(deployer)
> File
>
"/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py",
> line 670, in spawn
> raise Exception("server failed to restart")
> ')
> See the installation logs and the following files/directories for more
> information:
> /var/log/pki/pki-tomcat
> [error] RuntimeError: CA configuration failed.
> CA configuration failed.
>
> and configuration was:
> ```
> [DEFAULT]
> ipa_key_algorithm=SHA256withEC
> ipa_key_size=nistp384
> ipa_key_type=ecc
> ipa_signing_algorithm=SHA256withEC
> pki_ca_signing_key_size=nistp384
>
> pki_hsm_enable=True
> pki_hsm_libfile=/usr/lib64/opensc-pkcs11.so
> pki_hsm_modulename=nitrohsm
> pki_token_name=UserPIN (SmartCard-HSM)
> pki_token_password=648219
>
> pki_random_serial_numbers_enable=True
> ```
You're really on the bleeding edge. I don't know that HSM works reliably
yet. An ECC CA is not something we're planning on ever doing (keys too
small) so you're on your own with that.
Yes, to both not supporting ECC CA
(following NIST recommendations) and
to not have it working yet in Dogtag with HSM.
Do I understand right that for non-ECC CA you have it working apart from
a negotiation error? I think Christian saw negotiation error too and
there should be a bug opened at Dogtag side for something related.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland