freeipa

#9685 ipa-custodia-check fails in fips mode (f40/41)
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The command /usr/libexec/ipa/ipa-custodia-check fails in FIPS mode on fedora 40.

Steps to Reproduce

  1. Configure a machine in FIPS mode: fips-mode-setup --enable; reboot
  2. Install IPA package: dnf copr enable -y @freeipa/server-master-nightly; dnf install -y freeipa-server-dns
  3. Configure IPA server: ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  4. Call ipa-custodia-check: /usr/libexec/ipa/ipa-custodia-check server.ipa.test

Actual behavior

The call fails with:

[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: Platform: Linux-6.11.3-200.fc40.x86_64-x86_64-with-glibc2.39
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: IPA version: 4.13.0.dev202410180945+git
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: IPA vendor version: 4.13.0.dev202410180945+git-0.fc40
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: Realm: IPA.TEST
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: Host: server.ipa.test
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: Remote server: server.ipa.test
[2024-10-21T07:42:28 ipa-custodia-tester] <WARNING>: Performing self-test only.
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: File '/etc/ipa/default.conf' exists.
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: File '/etc/krb5.keytab' exists.
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: File '/etc/ipa/custodia/custodia.conf' exists.
[2024-10-21T07:42:28 ipa-custodia-tester] <INFO>: File '/etc/ipa/custodia/server.keys' exists.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Custodia client created.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Loaded key for usage 'sig' from '/etc/ipa/custodia/server.keys'.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: JWK KID matches host's service principal name 'host/server.ipa.test@IPA.TEST'.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Checked host LDAP keys 'host/server.ipa.test@IPA.TEST' for usage sig.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Local key for usage 'sig' matches key in LDAP.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Checked server LDAP keys 'host/server.ipa.test@IPA.TEST' for usage sig.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Loaded key for usage 'enc' from '/etc/ipa/custodia/server.keys'.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: JWK KID matches host's service principal name 'host/server.ipa.test@IPA.TEST'.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Checked host LDAP keys 'host/server.ipa.test@IPA.TEST' for usage enc.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Local key for usage 'enc' matches key in LDAP.
[2024-10-21T07:42:29 ipa-custodia-tester] <INFO>: Checked server LDAP keys 'host/server.ipa.test@IPA.TEST' for usage enc.
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'dm/DMHash': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ra/ipaCert': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/auditSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca_wrapped/auditSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca_wrapped/auditSigningCert cert-pki-ca/1.2.840.113549.3.7': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/caSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/ocspSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
[2024-10-21T07:42:29 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/subsystemCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
[ERROR] One or more tests have failed.

Expected behavior

The call should succeed.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

freeipa-server-4.13.0.dev202410180945+git-0.fc40.x86_64
freeipa-client-4.13.0.dev202410180945+git-0.fc40.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.0.4-3.fc40.x86_64
package pki-ca is not installed
krb5-server-1.21.3-1.fc40.x86_64

Output in verbose + debug mode:

# /usr/libexec/ipa/ipa-custodia-check --debug --verbose `hostname`
[2024-10-21T07:43:05 ipalib.sysrestore] <DEBUG>: Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
[2024-10-21T07:43:05 ipalib.sysrestore] <DEBUG>: Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
[2024-10-21T07:43:05 ipa-custodia-tester] <DEBUG>: IPA API bootstrapped
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: Platform: Linux-6.11.3-200.fc40.x86_64-x86_64-with-glibc2.39
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: IPA version: 4.13.0.dev202410180945+git
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: IPA vendor version: 4.13.0.dev202410180945+git-0.fc40
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: Realm: IPA.TEST
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: Host: server.ipa.test
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: Remote server: server.ipa.test
[2024-10-21T07:43:05 ipa-custodia-tester] <WARNING>: Performing self-test only.
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: File '/etc/ipa/default.conf' exists.
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: File '/etc/krb5.keytab' exists.
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: File '/etc/ipa/custodia/custodia.conf' exists.
[2024-10-21T07:43:05 ipa-custodia-tester] <INFO>: File '/etc/ipa/custodia/server.keys' exists.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Custodia client created.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Loaded key for usage 'sig' from '/etc/ipa/custodia/server.keys'.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: JWK KID matches host's service principal name 'host/server.ipa.test@IPA.TEST'.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Checked host LDAP keys 'host/server.ipa.test@IPA.TEST' for usage sig.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Local key for usage 'sig' matches key in LDAP.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Checked server LDAP keys 'host/server.ipa.test@IPA.TEST' for usage sig.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Loaded key for usage 'enc' from '/etc/ipa/custodia/server.keys'.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: JWK KID matches host's service principal name 'host/server.ipa.test@IPA.TEST'.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Checked host LDAP keys 'host/server.ipa.test@IPA.TEST' for usage enc.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Local key for usage 'enc' matches key in LDAP.
[2024-10-21T07:43:06 ipa-custodia-tester] <INFO>: Checked server LDAP keys 'host/server.ipa.test@IPA.TEST' for usage enc.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'dm/DMHash': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ra/ipaCert': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/auditSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca_wrapped/auditSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca_wrapped/auditSigningCert cert-pki-ca/1.2.840.113549.3.7': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/caSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/ocspSigningCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[2024-10-21T07:43:06 ipa-custodia-tester] <ERROR>: Failed to retrieve key 'ca/subsystemCert cert-pki-ca': This combination of padding and hash algorithm is not supported by this backend..
Traceback (most recent call last):
  File "/usr/libexec/ipa/ipa-custodia-check", line 257, in check_keys
    result = self.client.fetch_key(key, store=self.args.store)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/secrets/client.py", line 111, in fetch_key
    request = self.kemcli.make_request(keyname, encalg=encalg)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 214, in make_request
    return make_enc_kem(name, value,
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/ipaserver/custodia/message/kem.py", line 240, in make_enc_kem
    jwe.add_recipient(enc_key)
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwe.py", line 237, in add_recipient
    wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/jwcrypto/jwa.py", line 362, in wrap
    ek = rk.encrypt(cek, self.padfn)
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 550, in encrypt
    return _enc_dec_rsa(self._backend, self, plaintext, padding)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.12/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 85, in _enc_dec_rsa
    raise UnsupportedAlgorithm(
cryptography.exceptions.UnsupportedAlgorithm: This combination of padding and hash algorithm is not supported by this backend.
[ERROR] One or more tests have failed.

Version of python-cryptography:

# rpm -qa python3-cryptography
python3-cryptography-41.0.7-1.fc40.x86_64

Note: the issue is also seen in fedora 41 (python3-cryptography-43.0.0-2.fc41.x86_64) but has been fixed in fedora 42 with python-cryptography-43.0.0-3.fc42.

https://github.com/pyca/cryptography/issues/11512
Edited by frenaud

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
- Issue tagged with: tracker
Metadata
None

test-failure tracker

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.