Question

IFS Cloud 22.2 certificate install error

  • 5 July 2023
  • 8 replies
  • 307 views
C
Rank
Badge +7

Hi,

I'm getting an error when reinstalling MT with a SSL certificate. My .pfx password is correct.

 

ifscloud-values.yaml is as below

# Path to PKCS12 certificate if using third party certificate
certificateFile: F:\Artifacts\ifsroot\config\certs\certificate.pfx

certificatePassword: XxxxXxxxXxxx1Xxx

 

Error,

[Wed Jul 05 05:26:38 BST 2023] - INFO: chartVersion not found in properties, using helmChartVersion: 222.7.0
[Wed Jul 05 05:26:38 BST 2023] - INFO: Using existing certificate
[Wed Jul 05 05:26:38 BST 2023] - SEVERE: Unable to handle certificates. java.io.IOException: keystore password was incorrect
[Wed Jul 05 05:26:38 BST 2023] - INFO: Generating symmetric-key. This will only be persisted if the secret, 'symmetric-key' does not exist.
[Wed Jul 05 05:26:38 BST 2023] - INFO: Creating namespace
[Wed Jul 05 05:26:42 BST 2023] - INFO: Installing ifs-cloud
[Wed Jul 05 05:26:42 BST 2023] - INFO: Using chart ifscloud/ifs-cloud --version 222.7.0
[Wed Jul 05 05:26:42 BST 2023] - INFO: Doing a dry-run ..
[Wed Jul 05 05:26:42 BST 2023] - INFO: Running helm upgrade
[Wed Jul 05 05:26:43 BST 2023] - SEVERE: execution error at (ifs-cloud/charts/ifscore/templates/secrets.yaml:12:18): Value for tls.cert is required
[Wed Jul 05 05:26:43 BST 2023] - SEVERE: Failed to install ifs-cloud
[Wed Jul 05 05:26:43 BST 2023] - SEVERE: Failed to install ifs-cloud. Collected logs from command:
INFO: Creating namespace
namespace/ifstst created
"ifscloud" has been added to your repositories
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "ifscloud" chart repository
Update Complete. ΓÄêHappy Helming!ΓÄê
INFO: Installing ifs-cloud
INFO: Using chart ifscloud/ifs-cloud --version 222.7.0
INFO: Doing a dry-run ..
INFO: Running helm upgrade
history.go:53: [debug] getting history for release ifs-cloud
Release "ifs-cloud" does not exist. Installing it now.
install.go:172: [debug] Original chart version: "222.7.0"
install.go:189: [debug] CHART PATH: C:\Users\ADMINI~1\AppData\Local\Temp\1\helm\repository\ifs-cloud-222.7.0.tgz

Error: execution error at (ifs-cloud/charts/ifscore/templates/secrets.yaml:12:18): Value for tls.cert is required
helm.go:94: [debug] execution error at (ifs-cloud/charts/ifscore/templates/secrets.yaml:12:18): Value for tls.cert is required
SEVERE: Failed to install ifs-cloud

[Wed Jul 05 05:26:43 BST 2023] - SEVERE: Validation failed.

 

Please comment on above issue.

Thanks

8 replies

B
Rank
Userlevel 5
Badge +12

Hi Mayura,

Do you have a solutionset.yaml file located in ifsroot\deliveries\build-home\ifsinstaller\?
When running the installer.cmd command, the first few lines should indicate the logFileLocation, configuration file, and solution set file found. What does the output indicate?

Best regards,
Ben -- IFS

C
Rank
Badge +7

Hi Ben, 

Thanks for the reply.

Log file attached.

1 Attachment
B
Rank
Userlevel 5
Badge +12

The installation is detecting the solution file, so that looks good.
The output indicates that the keystore password is incorrect. This means that the specified password for the PFX file is wrong. From ifsroot, please run the following:

bin\jdk\bin\keytool.exe -list -v -storetype pkcs12 -keystore <path to your pfx file>

It will prompt for the password. Does it recognize your password?

 

Best regards, Ben -- IFS

B
Rank
Userlevel 5
Badge +12

One other thing. Does you certificate password begin with a special character such as !? (! has a special meaning YAML.) If so, please put single quotes around the password in ifscloud-values.yaml.

Best regards

C
Rank
Badge +7

Hi Ben,

Thanks for the reply,

Password does not have special characters, just characters and numbers

 

I'm getting following error for the command you suggested to run,

 

F:\Artifacts\ifsroot\bin\jdk\bin>keytool.exe -list -v -storetype pkcs12 -keystore F:\Artifacts\ifsroot\config\certs\certificate.pfx
Enter keystore password:
keytool error: java.io.IOException: keystore password was incorrect
java.io.IOException: keystore password was incorrect
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2108)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222)
        at java.base/java.security.KeyStore.load(KeyStore.java:1479)
        at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:1050)
        at java.base/sun.security.tools.keytool.Main.run(Main.java:397)
        at java.base/sun.security.tools.keytool.Main.main(Main.java:390)
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
        ... 6 more

F:\Artifacts\ifsroot\bin\jdk\bin>

 

But my password is correct and verified several times and also I installed it to PC.

Certificate purchased from ZeroSSL and converted to pfx as below,

 

C:\Users\xxxxxxxx.AzureAD\xxxxxSystems\xxxx_work\Work\IT_Policy\Servers\cert\2>copy /b certificate.crt + ca_bundle.crt full_chain.crt
certificate.crt
ca_bundle.crt
        1 file(s) copied.

 

C:\Users\xxxxxxx\xxxxxSystems\xxx_work\Work\IT_Policy\Servers\cert\2>openssl pkcs12 -export -out certificate.pfx -inkey private.key -in full_chain.crt
Enter Export Password:
Verifying - Enter Export Password:

C:\Users\xxxxAzureAD\xxxxxSystems\xxxx_work\Work\IT_Policy\Servers\cert\2>

 

Please comment

 

C
Rank
Badge +7

Hi Ben,

 

Further, I tried to installed same .pfx file with wrong password to my laptop gives error and aborted installation.

But with the correct password it installed successfully.

So this is not an issue with a wrong password associated with .pfx file. There could be some other reason.

Thanks,

 

N
Rank
Badge +3

Hi CovMayurJ,

 

Do you have a solution? I have the same error with certificate.

I’m sure it´s not a password problem…

 

Thanks!

C
Rank
Badge +4

We had the same issue while setting up MT for IFS Cloud.

 

The solution for us was to recreate the pfx by telling keytool to use specific PBE algorithms for encrypting both the private key and the certificate itself in the keystore with:

 

 -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1

 

Final creation statement:

openssl pkcs12 -export -out final.pfx -inkey private.key -in certificate.cer -passout pass:<yourcertppw> -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1

Reply


Terms & ConditionsCookie settings