Skip to content

Commit

Permalink
Fix: RHEL-45539 (#4795)
Browse files Browse the repository at this point in the history
CA Clone Installation is failing with 'Error verifying PKCS12 MAC; no PKCS12KDF support.' in FIPS mode.

This very simple fix only does the following.
The process fails when trying to export a cert out of the pkcs12 file into a pem file.
Currently the cmd fails becuase fips doesn't like the mac verfication alg.

Here, since we've already imported the p12 files into the nss db, using other cmds, it should be safe to do
this operation without asking openssl to do the mac verify.

Change-Id: I134c01ca4f15ef9093e9ff5aaa6c9c1bb820d9ac
  • Loading branch information
jmagne committed Jul 8, 2024
1 parent 4b29f9e commit 4a05d20
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions base/server/python/pki/server/deployment/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -709,6 +709,7 @@ def import_clone_pkcs12(self):

cmd_export_ca = [
'openssl', 'pkcs12',
'-nomacver',
'-in', pki_clone_pkcs12_path,
'-out', pki_ca_crt_path,
'-nodes',
Expand Down

0 comments on commit 4a05d20

Please sign in to comment.