Setting private_key_pw results in SSL Error

[lukehinds]

Environment

• OS / version: Fedora 29
• Processor architecture: X86_64
• TPM Manufacturer: Intel
• Keylime version: master

Description

When setting private_key_pw the keylime registrar exits with a stack trace.

# keylime_registrar
Using config file /etc/keylime.conf
2019-04-16 09:24:34.425 - keylime.cloudverifier_common - INFO - Setting up TLS...
Traceback (most recent call last):
  File "/usr/bin/keylime_registrar", line 11, in <module>
    load_entry_point('keylime==1.2', 'console_scripts', 'keylime_registrar')()
  File "/usr/lib/python2.7/site-packages/keylime-1.2-py2.7.egg/keylime/registrar.py", line 34, in main
    registrar_common.start(config.getint('general', 'registrar_tls_port'),config.getint('general', 'registrar_port'),config.get('registrar', 'db_filename'))
  File "/usr/lib/python2.7/site-packages/keylime-1.2-py2.7.egg/keylime/registrar_common.py", line 428, in start
    generatedir='reg_ca')
  File "/usr/lib/python2.7/site-packages/keylime-1.2-py2.7.egg/keylime/cloud_verifier_common.py", line 154, in init_mtls
    context.load_cert_chain(certfile=my_cert,keyfile=my_priv_key,password=my_key_pw)
ssl.SSLError: [SSL] PEM lib (_ssl.c:2798)

Reverting back to default results in the registrar starting without any issue.

Expected behavior vs. actual behavior

Steps to reproduce problem

1. Set private_key_pw = kjshd89y98hohfjhjhj in /etc/keylime.conf
2. Start the registrar

[jetwhiz]

Hi @lukehinds , if you're using CV-generated keys then the password for the registrar and tenant must be the same as the password set for the verifier (since they all use the same keys).

See the notes under tenant and registrar:

• https://github.com/keylime/python-keylime/blob/master/keylime.conf#L216
• https://github.com/keylime/python-keylime/blob/master/keylime.conf#L385

Does it work if you update those passwords to match the one you set in the cloud_verifier section?

[lukehinds]

Hi @jetwhiz , my bad I missed that.

I will keep this open and we can perhaps validate this somehow so its captured. Will change to enhancement.

[jetwhiz]

It could definitely use some clarification that this needs to be done. Maybe all three sections can mention that the related passwords must all be updated if they are CV-generated and the pw is not set to "default"?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.

[lukehinds]

Keep

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.