Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-2065

No suitable provider found for type 'PKCS11' on openjdk 11 when configuration is passed in provider-loader

    XMLWordPrintable

Details

    • Bug
    • Resolution: Duplicate
    • Major
    • None
    • None
    • API / SPI
    • None
    • Hide

      The below steps will pass using OpenJDK 8, but will throw an exception using OpenJDK 11.
      1. Configure NSS:

       mkdir /tmp/nssdb
 echo "pass123+" > /tmp/newpass.txt
 echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt
 MODUTIL_CMD="modutil -force -dbdir /tmp/nssdb"
 $MODUTIL_CMD -create
 $MODUTIL_CMD -changepw "NSS Certificate DB" -newpwfile /tmp/newpass.txt
 certutil -S -v 240 -k rsa -n "CN=localhost" -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt
 touch /tmp/nssdb/secmod.db

$JBOSS_HOME/bin/standalone.sh

$JBOSS_HOME/bin/jboss-cli -c

      2. Configure keystore:

       /subsystem=elytron/provider-loader=nss:add(class-names=["sun.security.pkcs11.SunPKCS11"], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=keystore},module=sun.jdk)

/subsystem=elytron/key-store=pkcs11ks:add(credential-reference={clear-text=pass123+}, type=PKCS11, providers=nss)
      Show
      The below steps will pass using OpenJDK 8, but will throw an exception using OpenJDK 11. 1. Configure NSS: mkdir /tmp/nssdb echo "pass123+" > /tmp/newpass.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt MODUTIL_CMD= "modutil -force -dbdir /tmp/nssdb" $MODUTIL_CMD -create $MODUTIL_CMD -changepw "NSS Certificate DB" -newpwfile /tmp/newpass.txt certutil -S -v 240 -k rsa -n "CN=localhost" -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt touch /tmp/nssdb/secmod.db $JBOSS_HOME/bin/standalone.sh $JBOSS_HOME/bin/jboss-cli -c 2. Configure keystore: /subsystem=elytron/provider-loader=nss:add( class- names=[ "sun.security.pkcs11.SunPKCS11" ], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=keystore},module=sun.jdk) /subsystem=elytron/key-store=pkcs11ks:add(credential-reference={clear-text=pass123+}, type=PKCS11, providers=nss)
    • Hide

      Possible workaround is to configure PKCS11 provider statically in java.security.

      Show
      Possible workaround is to configure PKCS11 provider statically in java.security.
    • Undefined

    Description

       Steps to Reproduce work using OpenJDK 8, but on OpenJDK 11 the following exception gets thrown:

      {{ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([}}
{{ ("subsystem" => "elytron"),}}
{{ ("key-store" => "pkcs11ks")}}
{{]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.key-store.pkcs11ks" => "WFLYELY00004: Unable to start the service.}}
{{ Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'PKCS11'"}}}}

      Configuration loading for SunPKCS11 was changed after Java 8 and the constructor that accepts InputStream configuration is not present in openjdk 11. Maybe because of this, the configuration is ignored when it is passed in provider-loader. 

      Attachments

        Issue Links

          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. WFCORE-5239 No suitable provider found for type 'PKCS11' on openjdk 11 when configuration is passed in provider-loader

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              dvilkola@redhat.com Diana Krepinska
              dvilkola@redhat.com Diana Krepinska
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: