Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-3788

Using JKS truststore leads to "FIPS mode: only SunJSSE TrustManagers may be used"

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.0.0.ER7
    • 7.0.0.ER6
    • Management, Security
    • None
    • Hide

      1.
      Run SSLMasterSlaveOneWayTestCase in AS TS with system property jboss.test.host.slave.jvmhome and jboss.test.host.slave.controller.jvmhome pointing to fips java.

      [mchoma@localhost domain]$ pwd
/home/mchoma/workspace/git-repositories/wildfly-core-eap/testsuite/domain
[mchoma@localhost domain]$ mvn test -Dtest=SSLMasterSlaveOneWayTestCase -DtestLogToFile=false -Djboss.test.host.slave.jvmhome=$JAVA_HOME_FIPS -Djboss.test.host.slave.controller.jvmhome=$JAVA_HOME_FIPS

      2.
      Leads to startup error java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used.

      Show
      1. Run SSLMasterSlaveOneWayTestCase in AS TS with system property jboss.test.host.slave.jvmhome and jboss.test.host.slave.controller.jvmhome pointing to fips java. [mchoma@localhost domain]$ pwd /home/mchoma/workspace/git-repositories/wildfly-core-eap/testsuite/domain [mchoma@localhost domain]$ mvn test -Dtest=SSLMasterSlaveOneWayTestCase -DtestLogToFile= false -Djboss.test.host.slave.jvmhome=$JAVA_HOME_FIPS -Djboss.test.host.slave.controller.jvmhome=$JAVA_HOME_FIPS 2. Leads to startup error java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used.

    Description

      User can't start domain in FIPS mode when JKS truststore is used in master <-> slave host controllers communication. (Using PKCS11 keystore works well)

      [Host Controller] ^[[0m^[[31m15:52:23,822 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-8) MSC000001: Failed to start service jboss.server.controller.management.security_realm.SlaveManagementRealm.ssl-context-trust-only: org.jboss.msc.service.StartException in service jboss.server.controller.management.security_realm.SlaveManagementRealm.ssl-context-trust-only: WFLYDM0018: Unable to start service^[[0m
[Host Controller] ^[[31m        at org.jboss.as.domain.management.security.SSLContextService.start(SSLContextService.java:124)^[[0m
[Host Controller] ^[[31m        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)^[[0m
[Host Controller] ^[[31m        at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)^[[0m
[Host Controller] ^[[31m        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)^[[0m
[Host Controller] ^[[31m        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)^[[0m
[Host Controller] ^[[31m        at java.lang.Thread.run(Thread.java:745)^[[0m
[Host Controller] ^[[31mCaused by: java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used^[[0m
[Host Controller] ^[[31m        at sun.security.ssl.SSLContextImpl.chooseTrustManager(SSLContextImpl.java:124)^[[0m
[Host Controller] ^[[31m        at sun.security.ssl.SSLContextImpl.engineInit(SSLContextImpl.java:87)^[[0m
[Host Controller] ^[[31m        at javax.net.ssl.SSLContext.init(SSLContext.java:282)^[[0m
[Host Controller] ^[[31m        at org.jboss.as.domain.management.security.SSLContextService.start(SSLContextService.java:87)^[[0m
[Host Controller] ^[[31m        ... 5 more^[[0m
[Hos

      Attachments

        Issue Links

          blocks

          Tracker - Issue tracking a bug fix or improvement in another component JBEAP-4120 FIPS mode issues

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. WFCORE-1437 Using JKS truststore leads to "FIPS mode: only SunJSSE TrustManagers may be used"

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved

          Activity

            People

              darran.lofthouse@redhat.com Darran Lofthouse
              mchoma@redhat.com Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: