Service provider unable to load private key from file

[Douglas E. Engert]

On 9/16/2013 1:31 PM, Brian Reindel wrote:
> Thank you for the openssl snippet. The key was output unencrypted, and
> it is valid. The key/cert are whatever is generated by using keygen.

The better openssl snippet would have been:

Use  "openssl errstr"  to print readable error text. It takes the hex version
of the error code. In your first e-mail the error code in decimal was 33558541

openssl errstr 200100D
error:0200100D:system library:fopen:Permission denied

So your problem is not an OpenSSL version problem, and what ever veriosn
of OpenSSL that comes with the OS should work.



>
> On Mon, Sep 16, 2013 at 1:53 PM, Douglas E. Engert <deengert at anl.gov> wrote:
>>
>>
>> On 9/16/2013 12:15 PM, Brian Reindel wrote:
>>> -rw-r--r--. 1 root  root   1062 Sep 16 11:20 sp-cert.pem
>>> -rw-------. 1 shibd shibd  1704 Sep 16 11:20 sp-key.pem
>>
>> PEM file are text. If it is encrypted, it will have some lines like:
>> -----BEGIN RSA PRIVATE KEY-----
>> Proc-Type: 4,ENCRYPTED
>> DEK-Info: AES-256-CBC,E540B27179249688B5C4C9C0E75E157D
>>
>> Use OpenSSL to verify the key is valid and encrypted:
>>    openssl rsa -text -in sp-key.pem
>>
>> This will also output the unencrypted key in PEM format too.
>>
>>
>>> That gives me the same error. While this:
>>>
>>> -rw-r--r--. 1 root  root   1062 Sep 16 11:20 sp-cert.pem
>>> -rw-r--r--. 1 shibd shibd  1704 Sep 16 11:20 sp-key.pem
>>>
>>> Gives "Segmentation fault (core dumped)" and the service fails to
>>> start. I'm not sure why giving more permissions would return a worse
>>> result, but that is what is happening. One the owner has read on the
>>> key it fails with that.
>>>
>>>
>>> On Mon, Sep 16, 2013 at 12:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>>> On 9/16/13 12:12 PM, "Brian Reindel" <brian at reindel.com> wrote:
>>>>>
>>>>> The permissions are as follows:
>>>>>
>>>>> -rw-r--r--. 1 root root  1062 Sep 16 11:20 sp-cert.pem
>>>>> -rw-------. 1 root root  1704 Sep 16 11:20 sp-key.pem
>>>>
>>>> Those are invalid, the key has to be owned by shibd. They will be when
>>>> installed in the normal way.
>>>>
>>>> -- Scott
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>> --
>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>>
>>
>> --
>>
>>    Douglas E. Engert  <DEEngert at anl.gov>
>>    Argonne National Laboratory
>>    9700 South Cass Avenue
>>    Argonne, Illinois  60439
>>    (630) 252-5444
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444