dogtagpki

#3054 Installation fails when HSM token label contains a space
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

The NitroKey NitroHSM uses SmartCard-HSM. The token label of the HSM contains a space:

 pkcs11-tool --list-slots
Available slots:
Slot 0 (0x0): Nitrokey Nitrokey HSM (010000000000000000000000) 00 00
  token label        : UserPIN (SmartCard-HSM)
  token manufacturer : www.CardContact.de
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 24.13
  firmware version   : 2.5
  serial num         : DENK0101221
  pin min/max        : 6/15

error

Installation fails because TomcatJSS cannot find the token PIN:

# journalctl -u pki-tomcatd@pki-tomcat.service
...
Aug 22 11:19:31 master.hsm.example server[31184]: WARNING: TomcatJSS: token for hardware-UserPIN not found
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:34 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:35 master.hsm.example server[31184]: Enter password for UserPIN (SmartCard-HSM)
Aug 22 11:19:45 master.hsm.example server[31184]: WARNING: Exception processing realm [com.netscape.cms.tomcat.ProxyRealm@3bcfa3a7] background process
Aug 22 11:19:45 master.hsm.example server[31184]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Aug 22 11:19:45 master.hsm.example server[31184]:         at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:130)
Aug 22 11:19:45 master.hsm.example server[31184]:         at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1152)
Aug 22 11:19:45 master.hsm.example server[31184]:         at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5632)
Aug 22 11:19:45 master.hsm.example server[31184]:         at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1390)

Please note that the token is hardware-UserPIN instead of hardware-UserPIN (SmartCard-HSM).

analysis

The space in the token label breaks Dogtag installer:

  • The Python method create_hsm_password_conf creates password.conf with content:
internal=0Ho/otLZ>0ADg|f8.)W(a)PrKnOaN%H*2:+LU<6ql
hardware-UserPIN (SmartCard-HSM)=1234567
  • Later on, the file is overwritten. It looks like base/server/cms/src/org/dogtagpki/server/rest/SystemConfigService.java method initializeDatabase() overrides the file with content (note that the space is replaced with a =):
hardware-UserPIN=(SmartCard-HSM)=1234567
internal=0Ho/otLZ>0ADg|f8.)W(a)PrKnOaN%H*2:+LU<6ql
internaldb=Secret123
replicationdb=-941832518

Metadata Update from @mharmsen:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Consider using SoftHSM to test a fix for this:
* http://www.dogtagpki.org/wiki/SoftHSM

Metadata Update from @mharmsen:
- Issue assigned to dmoluguw

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.6 (was: 0.0 NEEDS_TRIAGE)

The issue is because (space) is being considered as a key-value separator: https://github.com/dogtagpki/pki/blob/master/base/server/cmscore/src/com/netscape/cmscore/base/SimpleProperties.java#L91

However, removing this space and using softhsm with label "softhsm token" (label with space), throws the following error:

2018-08-27 16:26:48 [https-jsse-nio-8443-exec-10] SEVERE: Configuration failed: unable to login to token
org.mozilla.jss.crypto.TokenException: unable to login to token
        at org.mozilla.jss.pkcs11.PK11KeyPairGenerator.generateRSAKeyPairWithOpFlags(Native Method)
        at org.mozilla.jss.pkcs11.PK11KeyPairGenerator.generateKeyPair(PK11KeyPairGenerator.java:459)
        at org.mozilla.jss.crypto.KeyPairGenerator.genKeyPair(KeyPairGenerator.java:50)
        at com.netscape.cmsutil.crypto.CryptoUtil.generateRSAKeyPair(CryptoUtil.java:568)
        at com.netscape.cmsutil.crypto.CryptoUtil.generateRSAKeyPair(CryptoUtil.java:560)
        at com.netscape.cms.servlet.csadmin.ConfigurationUtils.createRSAKeyPair(ConfigurationUtils.java:1983)
        at org.dogtagpki.server.rest.SystemConfigService.processKeyPair(SystemConfigService.java:402)
        at org.dogtagpki.server.rest.SystemConfigService.processCerts(SystemConfigService.java:324)
        at org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:174)
        at org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.java:108)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Edited by dmoluguw

Fixed in
https://github.com/dogtagpki/pki/pull/35
https://github.com/dogtagpki/pki/pull/39
Edited by dmoluguw

Metadata Update from @dmoluguw:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

This bug requires tomcatjss fix as reported here: https://pagure.io/tomcatjss/issue/12

The fix for the tomcatjss has been done in PR: https://github.com/dogtagpki/tomcatjss/pull/3

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/3172

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
None
None
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.