Problems with FIPS mode

[pki-bot]

This issue was migrated from Pagure Issue #2500. Originally filed by mharmsen (@mharmsen) on 2016-10-05 18:58:36:

• Closed as Fixed
• Assigned to edewata (@edewata)
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=1382066

---

NSS token is hard coded in SigningUnit.java class causing Dogtag install to fail
when system is in FIPS mode.

Steps to Reproduce:

1. Configure system for FIPS
2. Attempt to install Dogtag

Actual results:

Install fails

Expected results:

Install succeeds

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-10-05 19:01:40

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1382081 (Red Hat Certificate System)

[pki-bot]

Comment from edewata (@edewata) at 2016-10-14 03:58:30

Fixed in master:

• 5be68e3

[pki-bot]

Comment from edewata (@edewata) at 2016-11-02 01:08:08

Additional changes in master:

• 613d8e8
• 650b00d

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-11-04 01:25:26

Cherry-picked to DOGTAG_10_3_BRANCH:

commit 8bef45df5e3d287111df8e0a33519a065e3e7b70
Author: Endi S. Dewata <edewata@redhat.com>
Date:   Tue Nov 1 22:49:22 2016 +0100

    Fixed KRA key recovery via CLI in FIPS mode.
    
    Based on investigation and solution provided by cfu and jmagne,
    the SecurityDataRecoveryService.serviceRequest() has been modified
    to use EncryptionUnit.unwrap_temp() for key recovery via CLI in
    FIPS mode.
    
    https://fedorahosted.org/pki/ticket/2500
    (cherry picked from commit 650b00dc57bb0c51c1e327ec3064531c26f80c43)

commit ec165a0d6cd805d1b5d4fbd4fff44ff00bfcaee0
Author: Endi S. Dewata <edewata@redhat.com>
Date:   Sat Oct 29 07:52:36 2016 +0200

    Reformatted SecurityDataRecoveryService.serviceRequest().
    
    The code in SecurityDataRecoveryService.serviceRequest() has been
    reformatted for clarity.
    
    https://fedorahosted.org/pki/ticket/2500
    (cherry picked from commit 613d8e8281cc336d7e1c8291abedb4b2321f93ec)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-02-27 14:08:30

Metadata Update from @mharmsen:

• Issue assigned to edewata
• Issue set to the milestone: 10.3.8