Hello, <div>The issue with the dummy DB was that some permissions to some files in it were not given. I did a chmod 777 to all files and now the dummy DB seems to be working fine. </div><div><br></div><div>I configured the NSS database with the crypto card(sun sca6000) as follows. </div>
<div><div>mkdir /opt/SMC/Apache2/nsscertdb</div><div><br></div><div>cd /opt/SMC/Apache2/nsscertdb</div><div><br></div><div>-certutil -N -d /opt/SMC/Apache2/nsscertdb</div><div><br></div><div>-modutil -dbdir . -nocertdb -force -add "Sun Crypto Accelerator" -libfile /usr/lib/libpkcs11.so -mechanisms RSA:DSA:RC4:DES</div>
<div><div> modutil -list -dbdir /opt/SMC/Apache2/nssdb</div><div>Using database directory /opt/SMC/Apache2/nssdb...</div><div><br></div><div>Listing of PKCS #11 Modules</div><div>-----------------------------------------------------------</div>
<div> 1. NSS Internal PKCS #11 Module</div><div> slots: 2 slots attached</div><div> status: loaded</div><div><br></div><div> slot: NSS Internal Cryptographic Services</div><div> token: NSS Generic Crypto Services</div>
<div><br></div><div> slot: NSS User Private Key and Certificate Services</div><div> token: NSS Certificate DB</div><div><br></div><div> 2. Sun Crypto Accelerator</div><div> library name: /usr/lib/libpkcs11.so</div>
<div> slots: 2 slots attached</div><div> status: loaded</div><div><br></div><div> slot: Sun Metaslot</div><div> token: Sun Metaslot</div><div><br></div><div> slot: Sun Crypto Softtoken</div>
<div> token: Sun Software PKCS#11 softtoken</div><div>-----------------------------------------------------------</div><div><br></div></div><div><br></div><div>certutil -R -s "C=IN, O=NSN, OU=SPA2, CN=<a href="http://sandeeprc.eu.org">sandeeprc.eu.org</a>" -h "Sun Metaslot" -o ismc.csr -d . -a -n ismc_cert</div>
<div><br></div><div>(Got the CSR signed from CA Cert)</div><div>certutil -A -d . -n "ismc_cert" -a -t "CT,," -i cert2.csr -h "Sun Metaslot"</div><div><br></div><div>certutil -A -d . -n "CACERT CA" -a -t "CTu,CTu,CTu" -i ca.txt -h "Sun Metaslot"</div>
<div><br></div><div>certutil -V -u V -d . -n "ismc_cert" -h "Sun Metaslot"</div><div><br></div><div>The certificate is verified corrrectly. In nss.conf, i gave the following directives to use this database</div>
<div><br></div><div>Now in NSS.conf I added the following lines to use the hardware accelarator</div><div>NSSNickname "Sun Metaslot:ismc_cert"</div><div>NSSCertificateDatabase /opt/SMC/Apache2/nssdb</div><div><br>
</div><div>Now everything is working fine, the requests are getting processed correctly. But the issue is that the rsaprivate value is not getting incremented in the kstat -n mca0 output. Which means that it is not using the hardware accelerator card. </div>
<div><br></div><div>I have also given cryptoadm enable metaslot token=<tokenname> so as to use the hardware accelerator. </div><div><br></div><div>Any suggestions? </div><div><br></div><div>(When we try to use mod_ssl using the pkcs patch, it s correctly incrementing the rsaprivate values.)</div>
<div><br></div><div><br></div><div><br></div><div><br></div><br><div class="gmail_quote">On Mon, Aug 10, 2009 at 8:40 PM, Rishi Renjith <span dir="ltr"><<a href="mailto:rishirenjith@gmail.com">rishirenjith@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hello, <div>We first tested with a self signed certificate using a crypto card to store it( used modutil -add), then this error was sporadic. Some 2-3 requests will go through fine and then the error occurs. After that we can get successful requests only if we restart the firefox browser, that too sometimes. ( The browser is running in FIPS mode)</div>
<div><br></div><div>Finally we tried to test with the dummy certificates created using the gencert utility in mod_nss, without the crypto card. In that case, we cannot get any successful responses. (The .conf files are with the dummy cert configuration)</div>
<div><br><div>Also please see inline for your questions. <br><br><div class="gmail_quote"><div class="im">On Mon, Aug 10, 2009 at 7:59 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div></div><div>Rishi Renjith wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello, We are trying to make apache work with mod_nss in Solaris10 x86 platform in our project, which currently uses mod_ssl. For that we did the following.<br>
1) Compiled and installed NSS with NSPR.<br>
2) Installed Apache compiled with mod_ssl<br>
3) Compiled and installed mod_nss for this Apache<br>
4) Created the dummy DB using gencert.sh fie in mod_nss<br>
5) Changed permissions for DB so that we can use it. The issue we are getting is that the browser(Firefox) says "SSL_Disabled", when trying to run in FIPS mode. When I checked the server logs, it says "SSL Input filter read failed." "Cannot connect, SSL is disabled". error. <br>
Is there any setting that we are missing?<br>
I am attaching the nss.conf and httpd.conf files.<br>
<br>
Versions used: Mod_nss: 1.0.8<br>
NSS and NSPR: nss-3.12.3.1-with-nspr-4.7.5<br>
Apache: 2.2.11<br>
</blockquote>
<br></div></div>
Ok, let me start with a couple of questions:<br>
<br>
1. Does it work when NSSFips is off?</blockquote></div><div><font color="#000099"> </font><i><font color="#000099">[Rishi] No. Even with NSSFips turned off, we keep getting the error.</font></i></div><div class="im">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
<br>
2. Why did you set NSSEnforceValidCerts to off?</blockquote></div><div><i><font color="#000099">[Rishi] We tested first with a self signed certificate, using crypto card. For that we turned the EnforceValidCerts off. </font></i></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
<br>
3. Can you share /opt/SMC/Apache2/logs/nsserror_log?<br>
<br>
4. Can you provide the output of: certutil -L -d /opt/SMC/Apache2/dummycert<br></div><font color="#888888"><i><font color="#000099">[Rishi] The output and log file, I will mail as soon as I get to office tomorrow.</font></i><br>
rob<br>
<br>
</font></blockquote></div><br></div></div>
</blockquote></div><br></div>