Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-15427

server-ssl-context with elytron provider

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Do
    • Major
    • None
    • 25.0.0.Final
    • Security
    • None
    • Hide
      1. download and extract https://github.com/wildfly/wildfly/releases/download/25.0.0.Final/wildfly-25.0.0.Final.zip
      2. start WildFly by standalone.sh
      3. start jboss-cli.sh and connect to the WildFly server
      4. update server-ssl-context to use elytron provider by command 
        /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=providers, value=elytron)
      5. reload or restart WildFly and you will get an error message
      Show
      download and extract https://github.com/wildfly/wildfly/releases/download/25.0.0.Final/wildfly-25.0.0.Final.zip start WildFly by standalone.sh start jboss-cli.sh and connect to the WildFly server update server-ssl-context to use elytron provider by command /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=providers, value=elytron) reload or restart WildFly and you will get an error message
    • Hide
      1) download and extract https://github.com/wildfly/wildfly/releases/download/25.0.0.Final/wildfly-25.0.0.Final.zip
      2) start WildFly by {{standalone.sh}}
      3) start {{jboss-cli.sh}} and connect to the WildFly server
      4) update {{server-ssl-context}} to use elytron provider by command
      {code}
      /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=providers, value=elytron)
      {code}
      5) reload or restart WildFly and you will get an error message
      Show
      1) download and extract https://github.com/wildfly/wildfly/releases/download/25.0.0.Final/wildfly-25.0.0.Final.zip 2) start WildFly by {{standalone.sh}} 3) start {{jboss-cli.sh}} and connect to the WildFly server 4) update {{server-ssl-context}} to use elytron provider by command {code} /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=providers, value=elytron) {code} 5) reload or restart WildFly and you will get an error message

    Description

      By default there exist two security providers in WildFly standalone.xml configuration: openssl and elytron

       <providers>
 <aggregate-providers name="combined-providers">
 <providers name="elytron"/>
 <providers name="openssl"/>
 </aggregate-providers>
 <provider-loader name="elytron" module="org.wildfly.security.elytron"/>
 <provider-loader name="openssl" module="org.wildfly.openssl"/>
 </providers>

      When server-ssl-context don't have specified ssl provider defined or openssl or combined-providers provider is used then WildFly starts normally and SSL works just fine. 

      <server-ssl-context name="applicationSSC" key-manager="applicationKM" />
or
<server-ssl-context name="applicationSSC" key-manager="applicationKM" providers="openssl"/>
or
<server-ssl-context name="applicationSSC" key-manager="applicationKM" providers="combined-providers"/>

      In case we configure elytron provider I get an error messages during Wildfly start and HTTPS doesn't work 

      12:00:16,533 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-5) MSC000001: Failed to start service org.wildfly.security.ssl-context.applicationSSC: org.jboss.msc.service.StartException in service org.wildfly.security.ssl-context.applicationSSC: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
	at org.wildfly.extension.elytron@17.0.0.Final-redhat-20210930//org.wildfly.extension.elytron.SSLDefinitions$6.lambda$getValueSupplier$1(SSLDefinitions.java:1372)
	at org.wildfly.extension.elytron@17.0.0.Final-redhat-20210930//org.wildfly.extension.elytron.TrivialService.start(TrivialService.java:61)

	...

12:00:16,816 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "elytron"),
    ("server-ssl-context" => "applicationSSC")
]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.security.ssl-context.applicationSSC" => "java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria
    Caused by: java.security.NoSuchAlgorithmException: ELY04001: No algorithm found matching TLS/SSL protocol selection criteria"}}
	
	...

12:00:16,848 ERROR [org.jboss.as] (Controller Boot Thread) WFLYSRV0026: JBoss EAP 8.0.0.Alpha (WildFly Core 17.0.0.Final-redhat-20210930) started (with errors) in 1698ms - Started 290 of 535 services (3 services failed or missing dependencies, 336 services are lazy, passive or on-demand)

      Is there an explanation why this happens? Is there some dependency on openssl provider we don't see that may cause this failure when we explicitly configure elytron provider only?

      same behavior is also for WildFly 24.0.1.Final

      Attachments

        Issue Links

          is related to

          Task - Represents a small unit of work that is not end-user facing. ELY-2228 Update the exception message that occurs when no SSLContext implementation is provided by the configured providers

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved

          Activity

            People

              fjuma1@redhat.com Farah Juma
              rhn-support-kstekovi Krystof Stekovic
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: