WLS8.1sp2 - PKCS#11 Provider for WebCertificates error

Question

I'm trying to startup a WLS Server, which has his web certificates stored in a
HW Devices. Der CryptoProvider read via PKCS#11 the certificates out of the HW
Module. Unfortunatly the possibile operation via PKCS#11 are not the same as via
a PKCS#12 (basically: you can not read a PrivateKey out of a PKCS#11 as you do
out of Sun JKS implementation).
I got following error:
<29.04.2004 13.55 Uhr CEST> <Notice> <Security> <BEA-090170> <Loading the private
key stored under the alias Wxxxxxx.csintra.net from the CS_PKI keystore file C:\apps\Tip300\cs\pki\pki420\api\config\pkiapi_Websrv_etit.properties.>
<29.04.2004 13.55 Uhr CEST> <Notice> <Security> <BEA-090171> <Loading the identity
certificate stored under the alias Wxxxxxx.csintra.net from the CS_PKI keystore
file C:\apps\Tip300\cs\pki\pki420\api\config\pkiapi_Websrv_etit.properties.>
<29.04.2004 13.55 Uhr CEST> <Error> <WebLogicServer> <BEA-000297> <Inconsistent
security configuration, java.lang.Exception: The public key from the configured
server certificate and the configured server private key do not match.>
<29.04.2004 13.55 Uhr CEST> <Emergency> <Security> <BEA-090034> <Not listening
for SSL, java.io.IOException: Inconsistent security configuration, The public
key from the configured server certificate and the configured server private key
do not match..>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000329> <Started WebLogic
Admin Server "myserver" for domain"cfwdomain" running in Production Mode>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000360> <Server started
in RUNNING mode>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000355> <Thread "ListenThread.Default"
listening on port 7770, ip address *.*>
Is anyone already sperimenting with PKCS#11 and WLS8.1sp2?
Has anyone had the same problem or does it depend from the crypto provider we
are using?
Best Regards
carlo

Answer 1

The error happened when the ssl implementation tried to test the keys. To check
whether they match it obtained raw RSA Cipher (RSA/ECB/NoPadding) and tried to
encrypt some text with the private key and decrypt it with the public key. Since
the private key is not a real key it failed. So if you had an RSA cipher provider
installed that could work with your hw accelerator to encrypt with that private
key you could work around this problem.
In 8.1 we support nCipher HW accelerator, and we had to work around several issues
to make it work. One of the workarounds was to ignore the KeyManagementException
that happens during this key match check when nCipher is installed. Apparently
in your case this exception does not happen and this check executes normally,
but returns the negative result.
Pavel.
"Carlo de Rossi" <[email protected]> wrote:
>
I'm trying to startup a WLS Server, which has his web certificates stored
in a
HW Devices. Der CryptoProvider read via PKCS#11 the certificates out
of the HW
Module. Unfortunatly the possibile operation via PKCS#11 are not the
same as via
a PKCS#12 (basically: you can not read a PrivateKey out of a PKCS#11
as you do
out of Sun JKS implementation).
I got following error:
<29.04.2004 13.55 Uhr CEST> <Notice> <Security> <BEA-090170> <Loading
the private
key stored under the alias Wxxxxxx.csintra.net from the CS_PKI keystore
file C:\apps\Tip300\cs\pki\pki420\api\config\pkiapi_Websrv_etit.properties.>
<29.04.2004 13.55 Uhr CEST> <Notice> <Security> <BEA-090171> <Loading
the identity
certificate stored under the alias Wxxxxxx.csintra.net from the CS_PKI
keystore
file C:\apps\Tip300\cs\pki\pki420\api\config\pkiapi_Websrv_etit.properties.>
<29.04.2004 13.55 Uhr CEST> <Error> <WebLogicServer> <BEA-000297> <Inconsistent
security configuration, java.lang.Exception: The public key from the
configured
server certificate and the configured server private key do not match.>
<29.04.2004 13.55 Uhr CEST> <Emergency> <Security> <BEA-090034> <Not
listening
for SSL, java.io.IOException: Inconsistent security configuration, The
public
key from the configured server certificate and the configured server
private key
do not match..>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000329> <Started
WebLogic
Admin Server "myserver" for domain"cfwdomain" running in Production Mode>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000360> <Server
started
in RUNNING mode>
<29.04.2004 13.55 Uhr CEST> <Notice> <WebLogicServer> <BEA-000355> <Thread
"ListenThread.Default"
listening on port 7770, ip address *.*>
Is anyone already sperimenting with PKCS#11 and WLS8.1sp2?
Has anyone had the same problem or does it depend from the crypto provider
we
are using?
Best Regards
carlo