From c031ff612f1405969b4d0c76c3f6ecc19edd6b90 Mon Sep 17 00:00:00 2001 From: Jack Magne Date: Tue, 29 Jun 2021 16:41:25 -0700 Subject: [PATCH] Resolves: rhbz#1975406 - IPA installation fails during pki-tomcatd setup. --- admin-cert-p12.patch | 32 ++++++++++++++++++++++++++++++++ pki-core.spec | 7 ++++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 admin-cert-p12.patch diff --git a/admin-cert-p12.patch b/admin-cert-p12.patch new file mode 100644 index 0000000..d39831e --- /dev/null +++ b/admin-cert-p12.patch @@ -0,0 +1,32 @@ +From 0371cd21488648b779d6b7e2af2d893f86a182bc Mon Sep 17 00:00:00 2001 +From: Christian Heimes +Date: Thu, 24 Jun 2021 11:19:46 +0200 +Subject: [PATCH] PKCS#12 export: encrypt private key with AES + +pk12util export defaults to "PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 +CBC". The algorithm is no longer supported by OpenSSL 3.0.0. Use modern +PBES2 with AES-128-CBC to encrypt private key and leave public certs +unencrypted. + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1975406 +Signed-off-by: Christian Heimes +--- + base/server/python/pki/server/deployment/pkihelper.py | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py +index eb407e01e1..7c197b07f1 100644 +--- a/base/server/python/pki/server/deployment/pkihelper.py ++++ b/base/server/python/pki/server/deployment/pkihelper.py +@@ -1997,6 +1997,11 @@ def create_file(self, out_file, nickname, out_pwfile, + logger.error(log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE) + raise Exception(log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE) + ++ # encrypt private keys with PKCS#5 PBES2 ++ command.extend(["-c", "AES-128-CBC"]) ++ # don't encrypt public certs ++ command.extend(["-C", "NONE"]) ++ + logger.debug('Command: %s', ' '.join(command)) + with open(os.devnull, "w") as fnull: + subprocess.check_call(command, stdout=fnull, stderr=fnull) diff --git a/pki-core.spec b/pki-core.spec index 2a15758..da2728e 100644 --- a/pki-core.spec +++ b/pki-core.spec @@ -13,7 +13,7 @@ License: GPLv2 and LGPLv2 # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 11.0.0 -Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To create a tarball from a version tag: @@ -31,6 +31,8 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver # > pki-VERSION-RELEASE.patch # Patch: pki-VERSION-RELEASE.patch +Patch1: admin-cert-p12.patch + # md2man isn't available on i686. Additionally, we aren't generally multi-lib # compatible (https://fedoraproject.org/wiki/Packaging:Java) # so dropping i686 everywhere but RHEL-8 (which we've already shipped) seems @@ -1370,5 +1372,8 @@ fi ################################################################################ %changelog +* Tue Jun 29 2021 Red Hat PKI Team - 11.0.0-0.2 +- Resolves: rhbz#1975406 - IPA installation fails during pki-tomcatd setup. + * Fri Jun 25 2021 Red Hat PKI Team - 11.0.0-0.1 - Rebase to PKI 11.0.0-alpha1