Open fcami opened 3 years ago
hmmm. I'm not sure if I'm looking at the right place. But, my initial investigation shows the error in Dirsrv logs:
[03/Oct/2020:09:32:42.477153616 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
[03/Oct/2020:09:32:42.480435848 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[03/Oct/2020:09:32:42.643436711 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
[03/Oct/2020:09:32:42.644598462 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[03/Oct/2020:09:32:42.647994200 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
[03/Oct/2020:09:32:42.817731801 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES
[03/Oct/2020:09:32:42.818865405 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[03/Oct/2020:09:32:42.978169315 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
[03/Oct/2020:09:32:42.979390985 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.
[03/Oct/2020:09:32:42.980148539 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption.
I believe I have seen this error before (i think). Looking at the installed packages:
pki-base-10.9.0-0.4.fc32.noarch
pki-base-java-10.9.0-0.4.fc32.noarch
pki-ca-10.9.0-0.4.fc32.noarch
pki-kra-10.9.0-0.4.fc32.noarch
pki-server-10.9.0-0.4.fc32.noarch
pki-symkey-10.9.0-0.4.fc32.x86_64
pki-tools-10.9.0-0.4.fc32.x86_64
Is there any reason why IPA tests are executed with 10.9.0-0.4
packages? The latest stable version available on Fedora is 10.9.4-1
@SilleBille the kra spawn error happens at 2020-10-03 09:34:27:
2020-10-03 09:34:21 DEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://master.ipa.test:443 --ignore-cert-status UNTRUSTED_ISSUER ca-cert-signing-export --pkcs7
2020-10-03 09:34:27 ERROR: CalledProcessError: Command '['pki', '-d', '/etc/pki/pki-tomcat/alias', '-f', '/etc/pki/pki-tomcat/password.conf', '-U', 'https://master.ipa.test:443', '--ignore-cert-status', 'UNTRUSTED_ISSUER', 'ca-cert-signing-export', '--pkcs7']' returned non-zero exit status 255.
File "/usr/lib/python3.8/site-packages/pki/server/pkispawn.py", line 575, in main
scriptlet.spawn(deployer)
File "/usr/lib/python3.8/site-packages/pki/server/deployment/scriptlets/configuration.py", line 756, in spawn
pem_chain = self.get_cert_chain(instance, issuing_ca)
File "/usr/lib/python3.8/site-packages/pki/server/deployment/scriptlets/configuration.py", line 543, in get_cert_chain
output = subprocess.check_output(cmd)
File "/usr/lib64/python3.8/subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib64/python3.8/subprocess.py", line 512, in run
raise CalledProcessError(retcode, process.args,
and at the same time, the pki/debug logs show the following:
2020-10-03 09:34:27 [ajp-nio-127.0.0.1-8009-exec-4] SEVERE: Allocate exception for servlet [Resteasy]
java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/share/pki/server/webapps/pki/WEB-INF/lib/pki-cmsbundle.jar" "read")
It is really similar to https://github.com/dogtagpki/pki/issues/3299
report
pki-kra-spawn log
Short log:
Long log: