ssl_key_passphrase doesn't work starting from version 6.0.8
#391
Labels
Comments
|
I cc @robbavey for knowledge |
|
this might be an issue with the JDK itself - reading PKCS#8 encrypted private keys. |
|
@andsel I couldn't reproduce the same behaviour, but what I did observe was:
There is an existing integration test that uses What was the error you saw in your tests? |
|
When I said "work with 6.0.7" I meant that LS started without problems, I hadn't sent any data to LS input beats. The results of my tests are:
v = LS started without error |
|
extracted reproducer (~ pretty much what Netty does under the hood) : keyFile = ...
keyPassword = 'pass'
# NOTE: reading PKCS8 fails regardless or whether we register BC :
# require 'jopenssl/load'
# java.security.Security.addProvider(org.bouncycastle.jce.provider.BouncyCastleProvider.new)
def generateKeySpec(password, key)
if password.nil?
return java.security.spec.PKCS8EncodedKeySpec.new(key)
end
encryptedPrivateKeyInfo = javax.crypto.EncryptedPrivateKeyInfo.new(key)
puts encryptedPrivateKeyInfo
puts " algName: #{encryptedPrivateKeyInfo.getAlgName()}"
# "1.2.840.113549.1.5.13" (OID: PBEWithMD5AndDES)
algName = encryptedPrivateKeyInfo.getAlgName()
#algName = "PBEWithMD5AndDES"
keyFactory = javax.crypto.SecretKeyFactory.getInstance(algName)
# java.security.NoSuchAlgorithmException: 1.2.840.113549.1.5.13 SecretKeyFactory not available
# <init> at javax/crypto/SecretKeyFactory.java:122
# getInstance at javax/crypto/SecretKeyFactory.java:168
pbeKeySpec = javax.crypto.spec.PBEKeySpec.new(password)
pbeKey = keyFactory.generateSecret(pbeKeySpec)
cipher = javax.crypto.Cipher.getInstance(algName)
cipher.init(javax.crypto.Cipher::DECRYPT_MODE, pbeKey, encryptedPrivateKeyInfo.getAlgParameters())
return encryptedPrivateKeyInfo.getKeySpec(cipher)
end
load 'vendor/jar-dependencies/io/netty/netty-all/4.1.30.Final/netty-all-4.1.30.Final.jar'
encodedKeyBuf = Java::io.netty.handler.ssl.PemReader.readPrivateKey File.new(keyFile).to_input_stream
encodedKey = Java::byte[ encodedKeyBuf.readableBytes() ].new
encodedKeyBuf.readBytes(encodedKey).release()
encodedKeySpec = generateKeySpec(keyPassword == nil ? nil : keyPassword.to_java.toCharArray(), encodedKey)
puts "generating private key ..."
key = java.security.KeyFactory.getInstance("RSA").generatePrivate(encodedKeySpec)
puts "generated private-key: #{key}"JDK does not recognise the ObjectID (even if we help it supplying the name - it won't work): |
|
only way I was able to read the key is using BC specific (OpenSSL) APIs. * maybe with an empty password - not sure if than the key storage format is a bit more readable than |
|
Decrypting the key seems to work, when it is encrypted with a compatible cipher. (https://community.snowflake.com/s/article/Private-key-provided-is-invalid-or-not-supported-rsa-key-p8--data-isn-t-an-object-ID)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I don't know if it's related to #364, I suspect no since with version
6.0.7it workedCheck was done with Logstash
7.6.1Please post all product and debugging questions on our forum. Your questions will reach our wider community members there, and if we confirm that there is a bug, then we can open a new issue here.
6.0.8From Elasticsearch we use the tool
elasticsearch-certutiland thenopensslto convert the key in PEM>= 6.0.8while doesn't appear in version6.0.7. In that version was changed fromorg.logstash.netty.SslSimpleBuildertoorg.logstash.netty.SslContextcreate a private key
./bin/elasticsearch-certutil ca --pemgoes with the defaultunzip elastic-stack-ca.zip./bin/elasticsearch-certutil cert --pem --ca-key ca/ca.key --ca-cert ca/ca.crtgo with default valuesunzip certificate-bundle.zipinto/tmp/certs/openssl pkcs8 -topk8 -inform PEM -in instance.key -out instancekey.pkcs8put a password (empry or whatever string, then use it in the pipeline config)run Logstash
bin/logstash -f config/input_beats_pcks.conf
Now to prove that with beats plugin version
6.0.7works, remove the plugin and install the old version:Re re-run the config and see that the plugin works correctly.
If we use a PCKS#8 private key file without passphrase:
and comment out the setting
ssl_key_passphrasethen it will work with both plugin versionsThe text was updated successfully, but these errors were encountered: