Problem:
When running the foreman installer using the katello scenario, we are encountering the following error when trying to run the installer.
Expected outcome:
Installer to generate certificates on a FIPS enabled system
Foreman and Proxy versions:
3.2
Foreman and Proxy plugin versions:
foreman and foreman-proxy 3.2
katello 4.4
Distribution and version:
Rocky 8.5
Other relevant data:
I reviewed the patches available here: Error deploying Foreman and Katello on FIPS enabled system
The patches were applied and the install completed successfully. However, I did encounter an error during install see below. Does this need review and correction by a developer?
Before patching files:
[root@gsil-satellite lib]# foreman-installer --scenario katello --foreman-initial-organization=GSIL
2022-05-06 14:34:58 [NOTICE] [root] Loading installer configuration. This will take some time.
2022-05-06 14:35:02 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2022-05-06 14:35:02 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2022-05-06 14:35:11 [NOTICE] [configure] Starting system configuration.
2022-05-06 14:35:20 [NOTICE] [configure] 250 configuration steps out of 1700 steps complete.
2022-05-06 14:35:23 [ERROR ] [configure] Execution of '/bin/katello-ssl-tool --gen-ca --dir /root/ssl-build -p file:/etc/pki/katello/private/katello-default-ca.pwd --force --ca-cert-dir /etc/pki/katello-certs-tools/certs --set-common-name gsil-satellite.idm.gsil.smil --ca-cert katello-default-ca.crt --ca-key katello-default-ca.key --ca-cert-rpm katello-default-ca --set-country US --set-state North Carolina --set-city Raleigh --set-org Katello --set-org-unit SomeOrgUnit --set-email --cert-expiration 36500' returned 10: ERROR: Certificate Authority private SSL key generation failed:
2022-05-06 14:35:23 [ERROR ] [configure]
2022-05-06 14:35:23 [ERROR ] [configure] Generating RSA private key, 4096 bit long modulus (2 primes)
2022-05-06 14:35:23 [ERROR ] [configure] **********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
2022-05-06 14:35:23 [ERROR ] [configure] ********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
2022-05-06 14:35:23 [ERROR ] [configure] e is 65537 (0x010001)
2022-05-06 14:35:23 [ERROR ] [configure] 139714762856256:error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS:crypto/evp/digest.c:135:
2022-05-06 14:35:23 [ERROR ] [configure]
2022-05-06 14:35:23 [ERROR ] [configure] Generating private CA key: /root/ssl-build/katello-default-ca.key
2022-05-06 14:35:23 [ERROR ] [configure] /Stage[main]/Certs::Ca/Ca[katello-default-ca]/ensure: change from 'absent' to 'present' failed: Execution of '/bin/katello-ssl-tool --gen-ca --dir /root/ssl-build -p file:/etc/pki/katello/private/katello-default-ca.pwd --force --ca-cert-dir /etc/pki/katello-certs-tools/certs --set-common-name gsil-satellite.idm.gsil.smil --ca-cert katello-default-ca.crt --ca-key katello-default-ca.key --ca-cert-rpm katello-default-ca --set-country US --set-state North Carolina --set-city Raleigh --set-org Katello --set-org-unit SomeOrgUnit --set-email --cert-expiration 36500' returned 10: ERROR: Certificate Authority private SSL key generation failed:
2022-05-06 14:35:23 [ERROR ] [configure]
2022-05-06 14:35:23 [ERROR ] [configure] Generating RSA private key, 4096 bit long modulus (2 primes)
2022-05-06 14:35:23 [ERROR ] [configure] **********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
2022-05-06 14:35:23 [ERROR ] [configure] ********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
2022-05-06 14:35:23 [ERROR ] [configure] e is 65537 (0x010001)
2022-05-06 14:35:23 [ERROR ] [configure] 139714762856256:error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS:crypto/evp/digest.c:135:
2022-05-06 14:35:23 [ERROR ] [configure]
2022-05-06 14:35:23 [ERROR ] [configure] Generating private CA key: /root/ssl-build/katello-default-ca.key
2022-05-06 14:35:23 [ERROR ] [configure] Could not set 'present' on ensure: No such file or directory @ rb_sysopen - /root/ssl-build/katello-default-ca.crt (file: /usr/share/foreman-installer/modules/certs/manifests/ca.pp, line: 61)
2022-05-06 14:35:23 [ERROR ] [configure] Could not set 'present' on ensure: No such file or directory @ rb_sysopen - /root/ssl-build/katello-default-ca.crt (file: /usr/share/foreman-installer/modules/certs/manifests/ca.pp, line: 61)
2022-05-06 14:35:23 [ERROR ] [configure] Wrapped exception:
2022-05-06 14:35:23 [ERROR ] [configure] No such file or directory @ rb_sysopen - /root/ssl-build/katello-default-ca.crt
2022-05-06 14:35:23 [ERROR ] [configure] /Stage[main]/Certs::Ca/Ca[katello-server-ca]/ensure: change from 'absent' to 'present' failed: Could not set 'present' on ensure: No such file or directory @ rb_sysopen - /root/ssl-build/katello-default-ca.crt (file: /usr/share/foreman-installer/modules/certs/manifests/ca.pp, line: 61)
2022-05-06 14:35:23 [ERROR ] [configure] /Stage[main]/Certs::Ca/File[/etc/pki/katello/certs/katello-default-ca.crt]: Could not evaluate: Could not retrieve information from environment production source(s) file:///root/ssl-build/katello-default-ca.crt
2022-05-06 14:35:23 [ERROR ] [configure] /Stage[main]/Certs::Ca/File[/etc/pki/katello/certs/katello-server-ca.crt]: Could not evaluate: Could not retrieve information from environment production source(s) file:///root/ssl-build/katello-server-ca.crt
2022-05-06 14:35:23 [ERROR ] [configure] Failed to generate new truststore with temporary entry: Execution of '/bin/keytool -genkey -storetype pkcs12 -keystore /etc/candlepin/certs/truststore -storepass:file /etc/pki/katello/truststore_password-file -alias temporary-entry -dname CN=temporary-entry' returned 1: keytool error: java.security.KeyStoreException: Key protection algorithm not found: java.lang.NullPointerException
2022-05-06 14:35:25 [NOTICE] [configure] 500 configuration steps out of 1700 steps complete.
2022-05-06 14:35:25 [NOTICE] [configure] 750 configuration steps out of 1704 steps complete.
2022-05-06 14:35:26 [NOTICE] [configure] 1000 configuration steps out of 1711 steps complete.
2022-05-06 14:35:27 [NOTICE] [configure] 1250 configuration steps out of 1712 steps complete.
2022-05-06 14:35:34 [NOTICE] [configure] 1500 configuration steps out of 1712 steps complete.
2022-05-06 14:35:45 [NOTICE] [configure] System configuration has finished.
There were errors detected during install.
After patching files:
foreman-installer --scenario katello --foreman-initial-organization=GSIL
2022-05-06 15:12:25 [NOTICE] [root] Loading installer configuration. This will take some time.
2022-05-06 15:12:28 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2022-05-06 15:12:28 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2022-05-06 15:12:37 [NOTICE] [configure] Starting system configuration.
2022-05-06 15:12:46 [NOTICE] [configure] 250 configuration steps out of 1700 steps complete.
2022-05-06 15:13:20 [NOTICE] [configure] 500 configuration steps out of 1700 steps complete.
2022-05-06 15:13:20 [NOTICE] [configure] 750 configuration steps out of 1704 steps complete.
2022-05-06 15:13:21 [ERROR ] [configure] Failed to add certificate to keystore: Execution of '/bin/keytool -importkeystore -noprompt -srckeystore /tmp/temp_keystore20220506-22022-19m3g5n -srcstorepass:file /etc/pki/katello/keystore_password-file -destkeystore /etc/candlepin/certs/keystore -deststorepass:file /etc/pki/katello/keystore_password-file -srcalias tomcat -destalias tomcat -J-Dcom.redhat.fips=false' returned 1: Importing keystore /tmp/temp_keystore20220506-22022-19m3g5n to /etc/candlepin/certs/keystore...
2022-05-06 15:13:21 [ERROR ] [configure] keytool error: java.lang.Exception: Keystore file exists, but is empty: /etc/candlepin/certs/keystore
2022-05-06 15:13:24 [NOTICE] [configure] 1000 configuration steps out of 1711 steps complete.
2022-05-06 15:13:25 [NOTICE] [configure] 1250 configuration steps out of 1712 steps complete.
2022-05-06 15:16:18 [NOTICE] [configure] 1500 configuration steps out of 1712 steps complete.
2022-05-06 15:18:43 [NOTICE] [configure] System configuration has finished.
Executing: foreman-rake upgrade:run
=============================================
Upgrade Step 1/8: katello:correct_repositories. This may take a long while.
=============================================
Upgrade Step 2/8: katello:clean_backend_objects. This may take a long while.
Failed upgrade task: katello:clean_backend_objects, see logs for more information.
=============================================
Upgrade Step 3/8: katello:upgrades:4.0:remove_ostree_puppet_content. =============================================
Upgrade Step 4/8: katello:upgrades:4.1:sync_noarch_content. =============================================
Upgrade Step 5/8: katello:upgrades:4.1:fix_invalid_pools. I, [2022-05-06T15:18:53.562381 #27278] INFO -- : Corrected 0 invalid pools
I, [2022-05-06T15:18:53.562409 #27278] INFO -- : Removed 0 orphaned pools
=============================================
Upgrade Step 6/8: katello:upgrades:4.1:reupdate_content_import_export_perms. =============================================
Upgrade Step 7/8: katello:upgrades:4.2:remove_checksum_values. =============================================
Upgrade Step 8/8: katello:upgrades:4.4:publish_import_cvvs. Success!
* Foreman is running at https:......
.