Address Bugzilla: Bug 1560682 - (RFE) Migrate RHCS x509 cert and crl … #11

jmagne · 2018-06-16T01:05:29Z

…functionality to JSS.

This consists of a migration of low level X509 cert and crl related classes from dogtag into JSS.
This initial migration will allow users of jss to utilize these classes to create certs and crls.

The initial goal is to simply provide the classes from dogtag to be used in JSS.
A later goal will be to refactor dogtag to use the classes moved to JSS, but that will be for
a future ticket.

This migration will also address this issue:

Bug 1577991 - org.mozilla.jss.netscape.security.util.ObjectIdentifier cannot parse OID arcs larger than Integer.MAX_VALUE.

The file ObjectIdentifier.java has been modified to use BigInt instead of the int type, allowing for a greater range of values.

edewata · 2018-06-16T01:12:10Z

jss.spec.in

@@ -56,6 +58,8 @@ Requires:       slf4j
 Requires:       slf4j-jdk14
 %endif
 Requires:       apache-commons-lang
+Requires:       apache-commons-codec
+Requires: 	ldapjdk


Indentation

…functionality to JSS. This consists of a migration of low level X509 cert and crl related classes from dogtag into JSS. This initial migration will allow users of jss to utilize these classes to create certs and crls. The initial goal is to simply provide the classes from dogtag to be used in JSS. A later goal will be to refactor dogtag to use the classes moved to JSS, but that will be for a future ticket. This migration will also address this issue: Bug 1577991 - org.mozilla.jss.netscape.security.util.ObjectIdentifier cannot parse OID arcs larger than Integer.MAX_VALUE. The file ObjectIdentifier.java has been modified to use BigInt instead of the int type, allowing for a greater range of values. Fixed minor indentation issue in spec file.

The PK11RSAPrivateKey.getModulus() has been modified to get the modulus from the public key, which was converted from the private key using SECKEY_ConvertToPublicKey(). A new PK11Exception has been added as a generic exception for all PKCS dogtagpki#11-related errors. https://pagure.io/jss/issue/9

The JSSProvider has been modified to provide PKCS dogtagpki#11 keystore service using JSSKeyStoreSpi.

NSS identifies RSA private keys by setting the PKCS dogtagpki#11 CKA_ID attribute to the SHA-1 digest of the public key (modulus). PK11KeyWrapper can receive this modulus value (a byte[]) with a leading null byte. This results in the digest (CKA_ID) not matching what the rest of NSS expects, e.g. when adding the corresponding certificate, NSS fails to associate it with the private key, because it is looking for a different CKA_ID. This results in Dogtag lightweight CA key replication failures. Apparently the problem did not occur with the old DB backend, only with the new SQL backend. Or there was some other change in NSS that landed in Fedora 28, which prompted this issue. In either case, the resolve the problem by dropping the leading null byte from the modulus byte[]. Fixes: https://pagure.io/jss/issue/5 Change-Id: I4685d7e091b0adc72d5ca067f2d65c3c068c8f7a

The JSSKeyStoreSpi.engineDeleteEntry() has been modified to use JSS API to remove a cert/key from a PKCS dogtagpki#11 token. https://pagure.io/jss/issue/10

The JSSKeyStoreSpi.engineDeleteEntry() has been modified to use JSS API to remove a cert/key from a PKCS #11 token. https://pagure.io/jss/issue/10

The NSS SQL backend, unlike the DBM backend that preceded it, does not automatically create PKCS dogtagpki#11 public key objects when unwrapping private keys. When certificates are added, this can result in a failure to properly associate the certificate with a private key in the token. When unwrapping a private key, if the given public key wraps an NSS SECKEYPublicKey object, import the public key to the token as well. Change-Id: I146952382d535ad71d9914f3a43d7df5c0a0f510 Related: https://pagure.io/jss/issue/13

The NSS SQL backend, unlike the DBM backend that preceded it, does not automatically create PKCS #11 public key objects when unwrapping private keys. When certificates are added, this can result in a failure to properly associate the certificate with a private key in the token. When unwrapping a private key, if the given public key wraps an NSS SECKEYPublicKey object, import the public key to the token as well. Change-Id: I146952382d535ad71d9914f3a43d7df5c0a0f510 Related: https://pagure.io/jss/issue/13

The PK11Store.putKeysInVector() has been converted into loadPrivateKeys() which loads all private keys in the PKCS dogtagpki#11 token into a Collection instead of Vector.

A new CryptoStore.getPublicKeys() has been added to return all public keys in the PKCS dogtagpki#11 token.

A new CryptoStore.findPublicKey() has been added to find the public key corresponding to a private key in a PKCS dogtagpki#11 token. Currently it only supports RSA keys.

A new CryptoStore.deletePublicKey() method has been added to remove a public key from a PKCS dogtagpki#11 token.

A new CryptoStore.findPublicKey() has been added to find the public key corresponding to a private key in a PKCS #11 token. Currently it only supports RSA keys.

A new CryptoStore.deletePublicKey() method has been added to remove a public key from a PKCS #11 token.

We need to map PKCS11 Constants between their names and their values and also between their values and Algorithm identifiers. To do so, we add PKCS11Algorithm which enumerates identifiers common to both Algorithm and PKCS11Constants. This will let us call into the NSS API with the correct constant identifier from PKCS11, when needed. Signed-off-by: Alexander Scheel <ascheel@redhat.com>

This release features HSM support for PKCS dogtagpki#11 AES KeyWrap/Padding mechanism. Also in this release are several minor fixes to OCSP handling in SSLSocket code. Signed-off-by: Alexander Scheel <ascheel@redhat.com>

The KeyPairGeneratorSpi.Usage class has been converted into an enumeration that defines the same elements. These elements store the values of the corresponding PKCS dogtagpki#11 constants. The getVal() method has been simplified, but it will continue to work like before for backward compatibility. The opFlags and opFlagsMask fields in PK11KeyPairGenerator have been converted to long to match the PKCS dogtagpki#11 constants. The values will be downcasted to int if needed. The opFlagForUsage array in PK11KeyPairGenerator has become redundant since the PKCS dogtagpki#11 constants can be obtained from the enumeration elements, so it has been removed.

The KeyPairGeneratorSpi.Usage class has been converted into an enumeration that defines the same elements. These elements store the values of the corresponding PKCS dogtagpki#11 constants. The getVal() method has been simplified, but it will continue to work like before for backward compatibility. The opFlags and opFlagsMask fields in PK11KeyPairGenerator have been converted to long to match the PKCS dogtagpki#11 constants. The values will be down-casted to int if needed. The opFlagForUsage array in PK11KeyPairGenerator has become redundant since the PKCS dogtagpki#11 constants can be obtained from the enumeration elements, so it has been removed.

The KeyPairGeneratorSpi.Usage class has been converted into an enumeration that defines the same elements. These elements store the values of the corresponding PKCS dogtagpki#11 constants. The getVal() method has been simplified, but it will continue to work like before for backward compatibility. The opFlags and opFlagsMask fields in PK11KeyPairGenerator have been converted to long to match the PKCS dogtagpki#11 constants. The values will be down-casted to int whenever needed. The opFlagForUsage array in PK11KeyPairGenerator has become redundant since the PKCS dogtagpki#11 constants can be obtained from the enumeration elements, so it has been removed.

Currently the PKCS dogtagpki#11 constants are only tested on Rawhide and it's failing, but it's actually working fine on Fedora 33. For now the test has been moved into the Fedora 33 test so the CI will pass, but later the tests will need to be expanded to include newer Fedora versions. That way the PKCS dogtagpki#11 constants will be tested separately on each platform, so it will be easier to isolate the problem.

Currently the PKCS #11 constants are only tested on Rawhide and it's failing, but it's actually working fine on Fedora 33. For now the test has been moved into the Fedora 33 test so the CI will pass, but later the tests will need to be expanded to include newer Fedora versions. That way the PKCS #11 constants will be tested separately on each platform, so it will be easier to isolate the problem.

Currently the PKCS dogtagpki#11 constants are only tested on Rawhide and it's failing, but it's actually working fine on Fedora 33. For now the test has been moved into the Fedora 33 test so the CI will pass, but later the tests will need to be expanded to include newer Fedora versions. That way the PKCS dogtagpki#11 constants will be tested separately on each platform, so it will be easier to isolate the problem.

Currently the PKCS #11 constants are only tested on Rawhide and it's failing, but it's actually working fine on Fedora 33. For now the test has been moved into the Fedora 33 test so the CI will pass, but later the tests will need to be expanded to include newer Fedora versions. That way the PKCS #11 constants will be tested separately on each platform, so it will be easier to isolate the problem.

The PKCS dogtagpki#11 constants tests in fedora_33 and fedora_34 have been moved into a separate workflow such that it can be configured using the test MATRIX.

The PKCS dogtagpki#11 constants tests for Fedora 33 and 34 have been moved into a new workflow such that the platforms can be configured using the test MATRIX.

The PKCS dogtagpki#11 constants tests for Fedora 33 and 34 have been converted into a new workflow such that the platform versions will update automatically and can be configured using the test MATRIX.

The PKCS #11 constants tests for Fedora 33 and 34 have been converted into a new workflow such that the platform versions will update automatically and can be configured using the test MATRIX.

The PKCS dogtagpki#11 constants test failed on Fedora 40 since it has NSS 3.97 that introduced some new PKCS dogtagpki#11 constants. As a workaround the new constants need to be excluded until NSS 3.97 becomes available on all supported platforms. The test has also been modified to reuse the jss-builder image. Resolves: dogtagpki#993

The PKCS dogtagpki#11 constants test failed on Fedora 40 since it uses NSS 3.97 that provides some new PKCS dogtagpki#11 constants. As a workaround the new constants need to be excluded until NSS 3.97 becomes available on all supported platforms. The test has also been modified to reuse the jss-builder image which already has the build dependencies. Resolves: dogtagpki#993

The PKCS #11 constants test failed on Fedora 40 since it uses NSS 3.97 that provides some new PKCS #11 constants. As a workaround the new constants need to be excluded until NSS 3.97 becomes available on all supported platforms. The test has also been modified to reuse the jss-builder image which already has the build dependencies. Resolves: #993

edewata reviewed Jun 16, 2018

View reviewed changes

jmagne force-pushed the jacks-candlepin-master branch from 14475bb to 9400b5d Compare June 19, 2018 18:38

edewata approved these changes Jun 20, 2018

View reviewed changes

jmagne merged commit 485a5b6 into dogtagpki:master Jun 20, 2018

jmagne deleted the jacks-candlepin-master branch June 20, 2018 00:40

edewata added a commit to edewata/jss that referenced this pull request Jun 21, 2018

Enabled PKCS dogtagpki#11 keystore

95f80cc

The JSSProvider has been modified to provide PKCS dogtagpki#11 keystore service using JSSKeyStoreSpi.

edewata added a commit to edewata/jss that referenced this pull request Jun 28, 2018

Updated JSSKeyStoreSpi.engineDeleteEntry()

0360d76

The JSSKeyStoreSpi.engineDeleteEntry() has been modified to use JSS API to remove a cert/key from a PKCS dogtagpki#11 token. https://pagure.io/jss/issue/10

edewata mentioned this pull request Jun 28, 2018

Updated JSSKeyStoreSpi.engineDeleteEntry() #14

Merged

edewata added a commit that referenced this pull request Jun 29, 2018

Updated JSSKeyStoreSpi.engineDeleteEntry()

e6b5db2

The JSSKeyStoreSpi.engineDeleteEntry() has been modified to use JSS API to remove a cert/key from a PKCS #11 token. https://pagure.io/jss/issue/10

frasertweedale mentioned this pull request Jun 29, 2018

Import public key when unwrapping private key #15

Merged

edewata added a commit to edewata/jss that referenced this pull request Jul 12, 2018

Added CryptoStore.getPublicKeys()

dc5c24c

A new CryptoStore.getPublicKeys() has been added to return all public keys in the PKCS dogtagpki#11 token.

edewata added a commit to edewata/jss that referenced this pull request Jul 12, 2018

Added CryptoStore.deletePublicKey()

8fbbcd6

A new CryptoStore.deletePublicKey() method has been added to remove a public key from a PKCS dogtagpki#11 token.

edewata added a commit that referenced this pull request Jul 13, 2018

Added CryptoStore.findPublicKey()

b9bf9fb

A new CryptoStore.findPublicKey() has been added to find the public key corresponding to a private key in a PKCS #11 token. Currently it only supports RSA keys.

edewata added a commit that referenced this pull request Jul 13, 2018

Added CryptoStore.deletePublicKey()

cbf85ef

A new CryptoStore.deletePublicKey() method has been added to remove a public key from a PKCS #11 token.

emaldona mentioned this pull request Oct 15, 2018

PKCS11 Constants #41

Merged

edewata mentioned this pull request Apr 13, 2021

Convert KeyPairGeneratorSpi.Usage into enumeration #683

Merged

edewata mentioned this pull request May 3, 2021

Add PKCS11Constants test for Fedora 34 #689

Merged

rjrelyea mentioned this pull request Jul 9, 2021

NPE in Buffer.WriteCapacity() #781

Open

edewata added a commit to edewata/jss that referenced this pull request Jul 28, 2021

Add PKCS dogtagpki#11 tests

7b60847

edewata added a commit to edewata/jss that referenced this pull request Jul 28, 2021

Add PKCS dogtagpki#11 tests

2b7d12b

edewata mentioned this pull request Jul 28, 2021

Reorganize PKCS #11 constants tests #789

Merged

edewata mentioned this pull request Jul 29, 2021

Add support for loading keys from .p12 #680

Open

edewata added a commit to edewata/jss that referenced this pull request May 4, 2022

Add PKCS dogtagpki#11 tests

ed71faa

edewata added a commit to edewata/jss that referenced this pull request May 4, 2022

Add PKCS dogtagpki#11 tests

c5ff6e8

edewata added a commit to edewata/jss that referenced this pull request May 4, 2022

Add PKCS dogtagpki#11 tests

98f1064

edewata added a commit to edewata/jss that referenced this pull request May 4, 2022

Add PKCS dogtagpki#11 tests

1aefe4e

edewata added a commit to edewata/jss that referenced this pull request May 4, 2022

Add PKCS dogtagpki#11 tests

df99ba0

edewata mentioned this pull request Feb 16, 2024

Fix PKCS #11 constants test #995

Merged

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Address Bugzilla: Bug 1560682 - (RFE) Migrate RHCS x509 cert and crl … #11

Address Bugzilla: Bug 1560682 - (RFE) Migrate RHCS x509 cert and crl … #11

jmagne commented Jun 16, 2018

edewata Jun 16, 2018

Address Bugzilla: Bug 1560682 - (RFE) Migrate RHCS x509 cert and crl … #11

Address Bugzilla: Bug 1560682 - (RFE) Migrate RHCS x509 cert and crl … #11

Conversation

jmagne commented Jun 16, 2018

edewata Jun 16, 2018

Choose a reason for hiding this comment