Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-2065

No suitable provider found for type 'PKCS11' on openjdk 11 when configuration is passed in provider-loader

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Major Major
    • None
    • None
    • API / SPI
    • None
    • Hide

      The below steps will pass using OpenJDK 8, but will throw an exception using OpenJDK 11.
      1. Configure NSS:

       mkdir /tmp/nssdb
 echo "pass123+" > /tmp/newpass.txt
 echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt
 MODUTIL_CMD="modutil -force -dbdir /tmp/nssdb"
 $MODUTIL_CMD -create
 $MODUTIL_CMD -changepw "NSS Certificate DB" -newpwfile /tmp/newpass.txt
 certutil -S -v 240 -k rsa -n "CN=localhost" -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt
 touch /tmp/nssdb/secmod.db

$JBOSS_HOME/bin/standalone.sh

$JBOSS_HOME/bin/jboss-cli -c

      2. Configure keystore:

       /subsystem=elytron/provider-loader=nss:add(class-names=["sun.security.pkcs11.SunPKCS11"], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=keystore},module=sun.jdk)

/subsystem=elytron/key-store=pkcs11ks:add(credential-reference={clear-text=pass123+}, type=PKCS11, providers=nss)
      Show
      The below steps will pass using OpenJDK 8, but will throw an exception using OpenJDK 11. 1. Configure NSS: mkdir /tmp/nssdb echo "pass123+" > /tmp/newpass.txt echo "dsadasdasdasdadasdasdasdasdsadfwerwerjfdksdjfksdlfhjsdk" > /tmp/noise.txt MODUTIL_CMD= "modutil -force -dbdir /tmp/nssdb" $MODUTIL_CMD -create $MODUTIL_CMD -changepw "NSS Certificate DB" -newpwfile /tmp/newpass.txt certutil -S -v 240 -k rsa -n "CN=localhost" -t "u,u,u" -x -s "CN=localhost" -d /tmp/nssdb -f /tmp/newpass.txt -z /tmp/noise.txt touch /tmp/nssdb/secmod.db $JBOSS_HOME/bin/standalone.sh $JBOSS_HOME/bin/jboss-cli -c 2. Configure keystore: /subsystem=elytron/provider-loader=nss:add( class- names=[ "sun.security.pkcs11.SunPKCS11" ], configuration={name=testPkcs11, nssLibraryDirectory=/usr/lib64, nssSecmodDirectory=/tmp/nssdb, nssModule=keystore},module=sun.jdk) /subsystem=elytron/key-store=pkcs11ks:add(credential-reference={clear-text=pass123+}, type=PKCS11, providers=nss)
    • Hide

      Possible workaround is to configure PKCS11 provider statically in java.security.

      Show
      Possible workaround is to configure PKCS11 provider statically in java.security.
    • Undefined

       Steps to Reproduce work using OpenJDK 8, but on OpenJDK 11 the following exception gets thrown:

      {{ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([}}
{{ ("subsystem" => "elytron"),}}
{{ ("key-store" => "pkcs11ks")}}
{{]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.key-store.pkcs11ks" => "WFLYELY00004: Unable to start the service.}}
{{ Caused by: org.jboss.msc.service.StartException in anonymous service: WFLYELY00012: No suitable provider found for type 'PKCS11'"}}}}

      Configuration loading for SunPKCS11 was changed after Java 8 and the constructor that accepts InputStream configuration is not present in openjdk 11. Maybe because of this, the configuration is ignored when it is passed in provider-loader. 

              dvilkola@redhat.com Diana Krepinska (Inactive)
              dvilkola@redhat.com Diana Krepinska (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: