How to setup SSL with pgjdbc on FIPS enabled server.

[kato-sho]

Hello,

I configured for SSL with pgjdbc on FIPS enabled server by reference to the below link.
https://www.enterprisedb.com/blog/edb-tutorial-configure-ssl-edb-jdbc-fips-enabled-server

However, when I was trying to run a simple testing program, I got the following error.

[postgres@VM00099926 fips]$ java -cp .:postgresql-42.7.0.jar -Djavax.net.ssl.trustStore=NONE -Djavax.net.ssl.trustStoreType=PKCS11 JdbcTest
Setting up SSL Connection:
Exception in thread "main" org.postgresql.util.PSQLException: The SSLSocketFactory class provided org.postgresql.ssl.DefaultJavaSSLFactory could not be instantiated.
        at org.postgresql.core.SocketFactoryFactory.getSslSocketFactory(SocketFactoryFactory.java:68)
        at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:34)
        at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:620)
        at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:191)
        at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:258)
        at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:54)
        at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:263)
        at org.postgresql.Driver.makeConnection(Driver.java:443)
        at org.postgresql.Driver.connect(Driver.java:297)
        at java.sql.DriverManager.getConnection(DriverManager.java:664)
        at java.sql.DriverManager.getConnection(DriverManager.java:208)
        at JdbcTest.main(JdbcTest.java:18)
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at org.postgresql.util.ObjectFactory.instantiate(ObjectFactory.java:66)
        at org.postgresql.core.SocketFactoryFactory.getSslSocketFactory(SocketFactoryFactory.java:64)
        ... 11 more
Caused by: java.security.ProviderException: Initialization failed
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:438)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:131)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:224)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:206)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:206)
        at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:187)
        at sun.security.jca.ProviderList.getProvider(ProviderList.java:233)
        at sun.security.jca.ProviderList.getService(ProviderList.java:331)
        at sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
        at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156)
        at javax.net.ssl.SSLContext.getDefault(SSLContext.java:96)
        at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:122)
        at org.postgresql.ssl.DefaultJavaSSLFactory.<init>(DefaultJavaSSLFactory.java:19)
        ... 17 more
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_PIN_INCORRECT
        at sun.security.pkcs11.wrapper.PKCS11.C_Login(Native Method)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:422)
        ... 34 more

Has anyone else also run into this kind of problem? Can someone offer some solutions/suggestions?
I attached my setup details and tesing problem in the end.

---

The setup details and testing program:

1. OS:
   Red Hat Enterprise Linux release 8.8 (Ootpa)

2. java version:
   openjdk version "1.8.0_392"
   OpenJDK Runtime Environment (build 1.8.0_392-b08)
   OpenJDK 64-Bit Server VM (build 25.392-b08, mixed mode)

3. pgjdbc version:
   42.7.0

4. fips mode
   [root@VM00099926 fips]# fips-mode-setup --check
   FIPS mode is enabled.

5. java.security:

#
# Security providers used when FIPS mode support is active
#
fips.provider.1=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.fips.cfg
fips.provider.2=sun.security.provider.Sun
fips.provider.3=sun.security.ec.SunEC
fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS

nss.fips.cfg:
name = NSS-FIPS
nssLibraryDirectory = /usr/lib64
nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips

attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }

6. Testing program:

import java.io.File;
import java.io.FileOutputStream;
import java.io.PrintStream;
import java.sql.*;
import java.util.Properties;

public class JdbcTest
{
        public static void main(String[] args) throws Exception
        {
                System.out.println("Setting up SSL Connection: ");
                Class.forName("org.postgresql.Driver");
                Properties props = new Properties();
                props.setProperty("user","postgres");
                props.setProperty("ssl","true");
                props.setProperty("sslmode","verify-ca");
                props.setProperty("sslfactory","org.postgresql.ssl.DefaultJavaSSLFactory");
                Connection con = DriverManager.getConnection("jdbc:postgresql://localhost:27500/postgres", props);
                System.out.println("Connection opened:");
                System.out.println(con.isClosed());
                try {
                        con.close();
                        System.out.println("Connection closed:");
                        System.out.println(con.isClosed());
                }catch(Exception ex) {
                       ex.printStackTrace();
                }
        }
}

[davecramer]

The error is CKR_PIN_INCORRECT, googling finds some references to it.

[kato-sho]

Thank you for your advise. I could not find useful information.
When I enabled fips mode, I could not get any security providers.

[postgres@VM00099926 fips]$ java PinCheck
Exception in thread "main" java.security.ProviderException: Initialization failed
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:438)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:131)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:224)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:206)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:206)
        at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:187)
        at sun.security.jca.ProviderList.loadAll(ProviderList.java:282)
        at sun.security.jca.ProviderList.removeInvalid(ProviderList.java:299)
        at sun.security.jca.Providers.getFullProviderList(Providers.java:174)
        at java.security.Security.getProviders(Security.java:532)
        at PinCheck.main(PinCheck.java:9)
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_PIN_INCORRECT
        at sun.security.pkcs11.wrapper.PKCS11.C_Login(Native Method)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:422)
        ... 15 more

On the other hand, when I disabled fips mode, I could get security providers information.

[postgres@VM00099926 fips]$ java -Dcom.redhat.fips=false PinCheck
SUN
SunRsaSign
SunEC
SunJSSE
SunJCE
SunJGSS
SunSASL
XMLDSig
SunPCSC

Sample program is below.

import java.security.*;
import java.util.Arrays;
import java.util.List;

public class PinCheck
{
        public static void main(String[] args) throws Exception
        {
                List<Provider> ps = Arrays.asList(Security.getProviders());
                ps.forEach(p -> System.out.println(p.getName()));
        }
}

If you have any useful information, It would be helpful if you could share.

[davecramer]

Sounds like a java problem to me.

[davecramer]

https://www.oracle.com/java/technologies/javase-jce-all-downloads.html