Amlen imaserver adding ssl key aes25 does not work - imaserver crashes

[gfvh]

Hi

Steps reproduce

openssl genpkey -aes256 -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -out client.csr -key server.key
openssl req -x509 -new -nodes -key server.key -sha256 -days 7304 -out clieent.crt

Then add in imawebui under Certificate Profiles cert and key. Result is imaserver crashes. Tried on two separate docker servers.

openssl ciphers -V |grep AES256

      0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384    TLSv1.2 Kx=ECDH     Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xAD - ECDHE-ECDSA-AES256-CCM         TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(256)            Mac=AEAD
      0xC0,0x0A - ECDHE-ECDSA-AES256-SHA         TLSv1   Kx=ECDH     Au=ECDSA Enc=AES(256)               Mac=SHA1
      0xC0,0x14 - ECDHE-RSA-AES256-SHA           TLSv1   Kx=ECDH     Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0x9D - AES256-GCM-SHA384              TLSv1.2 Kx=RSA      Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x9D - AES256-CCM                     TLSv1.2 Kx=RSA      Au=RSA   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x3D - AES256-SHA256                  TLSv1.2 Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA256
      0x00,0x35 - AES256-SHA                     SSLv3   Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0x9F - DHE-RSA-AES256-GCM-SHA384      TLSv1.2 Kx=DH       Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x9F - DHE-RSA-AES256-CCM             TLSv1.2 Kx=DH       Au=RSA   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x6B - DHE-RSA-AES256-SHA256          TLSv1.2 Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA256
      0x00,0x39 - DHE-RSA-AES256-SHA             SSLv3   Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0xA9 - PSK-AES256-GCM-SHA384          TLSv1.2 Kx=PSK      Au=PSK   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xA5 - PSK-AES256-CCM                 TLSv1.2 Kx=PSK      Au=PSK   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x8D - PSK-AES256-CBC-SHA             SSLv3   Kx=PSK      Au=PSK   Enc=AES(256)               Mac=SHA1
      0x00,0xAB - DHE-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xA7 - DHE-PSK-AES256-CCM             TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x91 - DHE-PSK-AES256-CBC-SHA         SSLv3   Kx=DHEPSK   Au=PSK   Enc=AES(256)               Mac=SHA1
      0xC0,0x36 - ECDHE-PSK-AES256-CBC-SHA       TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(256)               Mac=SHA1
      0x00,0xAD - RSA-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=RSAPSK   Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0x00,0x95 - RSA-PSK-AES256-CBC-SHA         SSLv3   Kx=RSAPSK   Au=RSA   Enc=AES(256)               Mac=SHA1`

I have noticed adding without password rsa key works. Without aes256 cipher. On command line openssl password verify works.

What can do get aes256 as well working and with password for imaserver or is this bug?

env:

Almalinux 9
Selinux off
Imaserver: 1.0.0.2 20240124-1010_eclipse 2024-01-24 10:43

[matslindh]

This is caused by the current version of openssl in the new distributions used by the docker images (or by the base OS) not accepting -passin pass: with an empty password as signifying an empty password, but as querying the user for a password.

The amlen server gets stuck in an interactive prompt from openssl asking for the private key password. This can be seen if running the amlen server in the foregrounds (either in docker or by itself).

As far as I've been able to discern there is no option to just provide an empty password to verify whether the key is protected or not, but you can provide an invalid password to get the same behavior as earlier (i.e. use __DUMMY_PASSWORD_DO_NOT_USE__ or something similar as a placeholder (or if you want to make it more robust, call openssl twice with different dummy passwords, just to cover the case of someone using __DUMMY_PASSWORD_DO_NOT_USE__ as their actual password.

One of these locations is here:

https://github.com/eclipse/amlen/blob/main/server_main/scripts/certApply.sh#L323

I have a small patch that uses a dummy password in those three locations I've found so far (in certApply.sh - there is also a two instances of the same pattern in imacertutils.sh, but I haven't tested any changes there).