PowerFlex: Fejlen "Certifikater er ikke i overensstemmelse med algoritmebegrænsning", når du forsøger at registrere systemet med Secure Remote Services (SRS)

Dette problem kan opstå, når IM-gatewaycertifikatet ikke er selvsigneret, men i stedet signeret af en tredjepartsnøglecentermyndighed. CA-certifikaterne er allerede importeret til IM Gateway truststore i henhold til PowerFlex-dokumentationen.

Symptomer

Registreringsforsøg på Secure Remote Services giver følgende fejl:

# /opt/emc/scaleio/gateway/bin/FOSGWTool.sh --register_esrs_gateway --scaleio_gateway_ip $gw_ip --scaleio_gateway_user admin --scaleio_gateway_password $gw_pass --esrs_gateway_ip $esrs_hostname --connect_in_ip $gw_ip --esrs_gateway_user $esrs_user --esrs_gateway_password <PASSWORD>
 Exception in thread "main" org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://10.10.10.11/api/gatewayLogin": java.security.cert.CertificateException: Certificates do not conform to algorithm constraints; nested exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints
 at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:525)
 at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:473)
 at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:421)
 at com.emc.s3g.scaleio.installation.cli.SioGWTool.loginToRestGateway(SioGWTool.java:2563)
 at com.emc.s3g.scaleio.installation.cli.SioGWTool.main(SioGWTool.java:1754)
 Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints
        at sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:370)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:313)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:652)
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:471)
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:367)
        at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:376)
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:479)
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:457)
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:200)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:154)
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1290)
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1199)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:401)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:373)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:587)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:167)
        at org.springframework.http.client.SimpleBufferingClientHttpRequest.executeInternal(SimpleBufferingClientHttpRequest.java:76)
        at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)
        at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:49)
        at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:510)
        ... 4 more
Caused by: java.security.cert.CertificateException: Certificates do not conform to algorithm constraints
        at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1387)
        at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1312)
        at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1256)
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:636)
        ... 22 more
Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA1withRSA                             < =============================== this is an issue
        at sun.security.provider.certpath.AlgorithmChecker.check(AlgorithmChecker.java:237)
        at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1383)
        ... 25 more

Påvirkning

PowerFlex-systemet kunne ikke registreres med Secure Remote Services.

IM Gateway-certifikatet blev signeret af et gammelt CA-certifikat ved hjælp af SHA1 som signaturhashalgoritme. Som standard tillader Java ikke, at SHA1 og få andre ældre algoritmer bruges i certifikatstien på grund af potentielle sikkerhedsproblemer.

 

Som en løsning kan Java konfigureres til midlertidigt at acceptere gamle typer hashingalgoritmer - rediger java.security-filen, og kommenter de linjer, der svarer til posten "jdk.certpath.disabledAlgorithms":

#
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \
    RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224

For at få en permanent løsning skal du signere IM Gateway-certifikatet med CA ved hjælp af moderne og sikre hashingalgoritmer