Project

General

Profile

Actions
Copy link

Bug #37384

closed

During upgrade to Katello 4.11 issues are seen with Candlepin keystore when using FIPS

Added by Evgeni Golov 12 months ago. Updated 10 months ago.

Status:
Closed
Priority:
High
Assignee:
Evgeni Golov
Category:
Foreman modules
Target version:
Foreman - 3.9.3
Difficulty:
Triaged:
Yes
Bugzilla link:
2277005
Pull request:
https://github.com/theforeman/puppet-certs/pull/444, https://github.com/theforeman/puppet-certs/pull/445, https://github.com/theforeman/puppet-certs/pull/446, https://github.com/theforeman/foreman-installer/pull/931, https://github.com/theforeman/foreman-installer/pull/932
Fixed in Releases:
Foreman - 3.11.0, Foreman - 3.9.3
Found in Releases:
Red Hat JIRA:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2277005

When upgrading to Katello 4.11 in a FIPS enabled environment we are seeing issues related to regenerating and reimporting the candlepin-ca;

2024-04-24 11:22:55 [ERROR ] [configure] /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:candlepin-ca]/ensure: change from 'absent' to 'present' failed: Execution of '/bin/keytool -import -v -noprompt -storetype pkcs12 -keystore /etc/candlepin/certs/truststore -alias candlepin-ca -file /etc/candlepin/certs/candlepin-ca.crt -storepass:file /etc/pki/katello/truststore_password-file -J-Dcom.redhat.fips=false' returned 1: keytool error: java.io.IOException: keystore password was incorrect
2024-04-24 11:22:55 [ERROR ] [configure] java.io.IOException: keystore password was incorrect
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2089)
2024-04-24 11:22:55 [ERROR ] [configure] at java.security.KeyStore.load(KeyStore.java:1445)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.doCommands(Main.java:839)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.run(Main.java:380)
2024-04-24 11:22:55 [ERROR ] [configure] at sun.security.tools.keytool.Main.main(Main.java:373)
2024-04-24 11:22:55 [ERROR ] [configure] Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
Actions
Copy link

Also available in: Atom PDF