|
 |
3f51ca |
From 8f35c1c705a7584cdcc9ad5c6fb15ba940ec3f4a Mon Sep 17 00:00:00 2001
|
|
|
3f51ca |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
3f51ca |
Date: Thu, 23 Nov 2017 18:06:56 +0100
|
|
|
3f51ca |
Subject: [PATCH] Fix ca less IPA install on fips mode
|
|
|
3f51ca |
|
|
|
3f51ca |
When ipa-server-install is run in fips mode and ca-less, the installer
|
|
|
3f51ca |
fails when the keys are provided with --{http|dirsrv|pkinit}-cert-file
|
|
|
3f51ca |
in a separate key file.
|
|
|
3f51ca |
|
|
|
3f51ca |
The installer transforms the key into PKCS#8 format using
|
|
|
3f51ca |
openssl pkcs8 -topk8
|
|
|
3f51ca |
but this command fails on a fips-enabled server, unless the options
|
|
|
3f51ca |
-v2 aes256 -v2prf hmacWithSHA256
|
|
|
3f51ca |
are also provided.
|
|
|
3f51ca |
|
|
|
3f51ca |
Fixes:
|
|
|
3f51ca |
https://pagure.io/freeipa/issue/7280
|
|
|
3f51ca |
|
|
|
3f51ca |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
3f51ca |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
3f51ca |
---
|
|
|
3f51ca |
ipapython/certdb.py | 4 ++++
|
|
|
3f51ca |
1 file changed, 4 insertions(+)
|
|
|
3f51ca |
|
|
|
3f51ca |
diff --git a/ipapython/certdb.py b/ipapython/certdb.py
|
|
|
3f51ca |
index 114c58340253141706afa461ecaf87797562ca1d..f198811e0fd02c8925f0dcfa8764535b35ed29ed 100644
|
|
|
3f51ca |
--- a/ipapython/certdb.py
|
|
|
3f51ca |
+++ b/ipapython/certdb.py
|
|
|
3f51ca |
@@ -499,9 +499,13 @@ class NSSDatabase(object):
|
|
|
3f51ca |
"Can't load private key from both %s and %s" %
|
|
|
3f51ca |
(key_file, filename))
|
|
|
3f51ca |
|
|
|
3f51ca |
+ # the args -v2 aes256 -v2prf hmacWithSHA256 are needed
|
|
|
3f51ca |
+ # on OpenSSL 1.0.2 (fips mode). As soon as FreeIPA
|
|
|
3f51ca |
+ # requires OpenSSL 1.1.0 we'll be able to drop them
|
|
|
3f51ca |
args = [
|
|
|
3f51ca |
OPENSSL, 'pkcs8',
|
|
|
3f51ca |
'-topk8',
|
|
|
3f51ca |
+ '-v2', 'aes256', '-v2prf', 'hmacWithSHA256',
|
|
|
3f51ca |
'-passout', 'file:' + self.pwd_file,
|
|
|
3f51ca |
]
|
|
|
3f51ca |
if ((label != 'PRIVATE KEY' and key_password) or
|
|
|
3f51ca |
--
|
|
|
3f51ca |
2.13.6
|
|
|
3f51ca |
|