JDK21 jdk_security3_0_FAILED sun/security/pkcs11/KeyStore/CertChainRemoval.java PKCS11Exception: CKR_GENERAL_ERROR #17672
Comments
|
All the grinder appear to be failing the same way. Does it also fail on Adoptium? |
|
15x grinder w/ hotspot - all failed w/ |
|
@jasonkatonica fyi |
|
We should check if this still fails on the latest builds. We updated to the initial release candidate Aug 14. |
|
Still seen in a latest run - JDK21 x86-64_linux hotspot failed as well 3x grinder |
|
@jasonkatonica any ideas about this one, do you think we have a machine setup issue? |
|
The error CKR_ATTRIBUTE_READ_ONLY can be expected if running on a FIPS machine since the NSS database is read only. Perhaps the CKR_GENERAL_ERROR could indicate this too since in the stack it is attempting to insert a certificate into the PKCS11 database ( NSS ). Could it be that NSS, or another PKCS11 setup, is not on this machine? Non fips tests I would expect to work with a read / write database when not in fips mode. |
|
I added the internal machine names, which are also available in the grinders (while they remain). There were a number of machines used and they all failed. Can you pls look at one of these to see if NSS or another PKCS11 is installed? Or let me know how to check (it doesn't seem obvious). I also wonder if the account we are using to run testing needs special privilege to write? ubu22x86-svl-rt11-1, rhel8x86-rt1-1, cent8x86-rtp-rt7-1, cent9x86-svl-rt4-1 |
|
On rhel the NSS database is typically installed at The test itself can be coded to use any library and or nss database location. The test CertChainRemoval.java on line 72 is using a custom configuration file which points to the file p11-nss.txt , from there i am unsure what values it actually specifies for the location of the nssdb and library for I did check out the machine I could not however find any nssdb file on this system, I would assume we need this for this test to pass. The doc here seems to indicate on Ubuntu that we should expect the nssdb to be located in I also agree that the permissions to the nssdb file would need to allow for the jenkins user to read and write the file for this to work. |
|
Checking on this issue, will update shortly. |
|
Test case tried to add the following "pk1", "ca1" and "root" private keys and their certs. Failed when adding "ca1", line at "p11ks.setKeyEntry("ca1", caPrivKey, null, ca1Chain);". I commented the code of adding "ca1", then the other two, "pk1" and "root" can be added success without any issue. So, the issue happened on the key "ca1" and its cert. Right now, I am adding the debug output in PKCS11.java to print out all the CK Attribute when adding the key and cert. Since the failure error is due to "PKCS11Exception: CKR_ATTRIBUTE_READ_ONLY". |
|
This issue is due to a NSS behavior change in newer NSS releases. And there is a defect, link below, opened in OpenJDK to updates the PKCS11 KeyStore impl to work with the NSS behavior change. https://bugs.openjdk.org/browse/JDK-8309214 So, a question, do we will pick up the codes fix from OpenJDK repo, or we have to manually apply this code change? And, since it is not an issue introduced by us, so I don't think it is a blocker issue. |
|
It appears the OpenJDK fix is part of 20.0.1 which OpenJ9 will pick up in Oct before any OpenJ9 jdk21 release. |
|
@JasonFengJ9 once we have builds testing 20.0.1 (i.e. tonight) pls confirm if this is resolved. |
|
Passed in latest run |
Failure link
From an internal build(
rhel8x86-rtp-rt2-1):Rerun in Grinder - Change TARGET to run only the failed test targets.
Optional info
Failure output (captured from console output)
50x internal grinder
The text was updated successfully, but these errors were encountered: