search

theforeman / puppet-certs

Puppet module for dealing with SSL certs across other modules used in Katello
GNU General Public License v3.0
5 stars 39 forks source link

Fixes #37384 - properly pass fips=false when checking keystore #446

Closed evgeni closed 6 months ago

evgeni commented 6 months ago

In a FIPS-enabled environment, calling keytool -list with a wrong password doesn't yield an error, unless we also pass fips=false like we do when creating the keystore:

# keytool -list -keystore ./store -storepass wrong-password
Keystore type: PKCS11
Keystore provider: SunPKCS11-NSS-FIPS

Your keystore contains 0 entries

Passing fips=false makes it correctly raise the expected exception:

# keytool -list -keystore ./store -storepass wrong-password -J-Dcom.redhat.fips=false
keytool error: java.io.IOException: keystore password was incorrect

Fixes: 6fea0bbb4143ca439cff01bf9f0e54cf88140d10 (cherry picked from commit b9667a02bebf6cce0b96fbd631ce34fb27c325ec)