Project

General

Profile

Actions
Copy link

Bug #37384

closed

During upgrade to Katello 4.11 issues are seen with Candlepin keystore when using FIPS

Added by Evgeni Golov 5 months ago. Updated 3 months ago.

Status:
Closed
Priority:
High
Assignee:
Evgeni Golov
Category:
Foreman modules
Target version:
Foreman - 3.9.3
Difficulty:
Triaged:
Yes
Bugzilla link:
2277005
Pull request:
https://github.com/theforeman/puppet-certs/pull/444, https://github.com/theforeman/puppet-certs/pull/445, https://github.com/theforeman/puppet-certs/pull/446, https://github.com/theforeman/foreman-installer/pull/931, https://github.com/theforeman/foreman-installer/pull/932
Fixed in Releases:
Foreman - 3.11.0, Foreman - 3.9.3
Found in Releases:
Red Hat JIRA:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2277005

When upgrading to Katello 4.11 in a FIPS enabled environment we are seeing issues related to regenerating and reimporting the candlepin-ca;

2024-04-24 11:22:55 [ERROR ] [configure] /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:candlepin-ca]/ensure: change from 'absent' to 'present' failed: Execution of '/bin/keytool -import -v -noprompt -storetype pkcs12 -keystore /etc/candlepin/certs/truststore -alias candlepin-ca -file /etc/candlepin/certs/candlepin-ca.crt -storepass:file /etc/pki/katello/truststore_password-file -J-Dcom.redhat.fips=false' returned 1: keytool error: java.io.IOException: keystore password was incorrect
2024-04-24 11:22:55 [ERROR ] [configure] java.io.IOException: keystore password was incorrect
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2089)
2024-04-24 11:22:55 [ERROR ] [configure] at java.security.KeyStore.load(KeyStore.java:1445)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.doCommands(Main.java:839)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.run(Main.java:380)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.main(Main.java:373)
2024-04-24 11:22:55 [ERROR ] [configure] Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
Actions
Copy link
 #1

Updated by Evgeni Golov 5 months ago

  • Subject changed from During upgrade to Katello 4.11 issues are seen with Candlepin keystore to During upgrade to Katello 4.11 issues are seen with Candlepin keystore
  • Category set to Foreman modules
Actions
Copy link
 #2

Updated by The Foreman Bot 5 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/puppet-certs/pull/444 added
Actions
Copy link
 #3

Updated by Evgeni Golov 5 months ago

  • Description updated (diff)
Actions
Copy link
 #4

Updated by The Foreman Bot 5 months ago

  • Fixed in Releases 3.11.0 added
Actions
Copy link
 #5

Updated by The Foreman Bot 5 months ago

  • Pull request https://github.com/theforeman/puppet-certs/pull/445 added
Actions
Copy link
 #6

Updated by The Foreman Bot 5 months ago

  • Pull request https://github.com/theforeman/puppet-certs/pull/446 added
Actions
Copy link
 #7

Updated by Evgeni Golov 5 months ago

  • Status changed from Ready For Testing to Closed
Actions
Copy link
 #8

Updated by Evgeni Golov 5 months ago

  • Target version set to 3.9.3
Actions
Copy link
 #9

Updated by The Foreman Bot 5 months ago

  • Pull request https://github.com/theforeman/foreman-installer/pull/931 added
Actions
Copy link
 #10

Updated by The Foreman Bot 5 months ago

  • Pull request https://github.com/theforeman/foreman-installer/pull/932 added
Actions
Copy link
 #11

Updated by Griffin Sullivan 5 months ago

  • Fixed in Releases 3.9.3 added
Actions
Copy link
 #12

Updated by Ewoud Kohl van Wijngaarden 3 months ago

  • Triaged changed from No to Yes
Actions
Copy link
 #13

Updated by Ewoud Kohl van Wijngaarden 3 months ago

  • Subject changed from During upgrade to Katello 4.11 issues are seen with Candlepin keystore to During upgrade to Katello 4.11 issues are seen with Candlepin keystore when using FIPS
Actions
Copy link

Also available in: Atom PDF