sp-signing-key not recognized after upgrade

[Jonathan Proulx]

Hi All,

I just (temporarily?) inherited management of an application using
Shibboleth via Apache2 mod_shib.

I'm trying to move from a Debian11 based docker image to a Debian12
based docker image due to the recent security advisory.

But after rebuilding (using the same key that works in the older
image) I get "Unable to load private key from file
(/etc/shibboleth/sp-encrypt-key.pem)" in shibd.log.

shibd seems to be running as "_shibd" within the container and as that
user I'm able to run `openssl rsa -text -in
/etc/shibboleth/sp-signing-key.pem -noout` which shows `Private-Key:
(3072 bit, 2 primes)` and then the secret bits so it seems like the
user can read the key and openssl can parse it.

Today is the first day I've touched Shibboleth so hopefully the
solution to this is obvious to someone?

More log context:

2025-03-20 13:31:51 INFO XMLTooling.SecurityHelper : loading private key from file (/etc/shibboleth/sp-signing-key.pem)
2025-03-20 13:31:51 ERROR OpenSSL : error code: 75497580 in ../crypto/pem/pem_lib.c, line 763
2025-03-20 13:31:51 ERROR OpenSSL : error data: Expecting: CERTIFICATE
2025-03-20 13:31:51 ERROR OpenSSL : error code: 2147483661 in ../crypto/bio/bss_file.c, line 297
2025-03-20 13:31:51 ERROR OpenSSL : error data: calling fopen(/etc/shibboleth/sp-signing-key.pem, r)
2025-03-20 13:31:51 ERROR OpenSSL : error code: 268959746 in ../crypto/bio/bss_file.c, line 300
2025-03-20 13:31:51 ERROR XMLTooling.CredentialResolver.Chaining : caught exception processing embedded CredentialResolver element: Unable to load private key from file (/etc/shibboleth/sp-signing-key.pem).
2025-03-20 13:31:51 INFO XMLTooling.CredentialResolver.Chaining : building CredentialResolver of type File
2025-03-20 13:31:51 INFO XMLTooling.SecurityHelper : loading private key from file (/etc/shibboleth/sp-encrypt-key.pem)
2025-03-20 13:31:51 ERROR OpenSSL : error code: 2147483661 in ../crypto/bio/bss_file.c, line 297
2025-03-20 13:31:51 ERROR OpenSSL : error data: calling fopen(/etc/shibboleth/sp-encrypt-key.pem, r)
2025-03-20 13:31:51 ERROR OpenSSL : error code: 268959746 in ../crypto/bio/bss_file.c, line 300
2025-03-20 13:31:51 ERROR XMLTooling.CredentialResolver.Chaining : caught exception processing embedded CredentialResolver element: Unable to load private key from file (/etc/shibboleth/sp-encrypt-key.pem).|

Version info:

Non-working new versions (Debian12):
------------------------------------------------------------------
2025-03-20 13:31:51 INFO XMLTooling.Config : xmltooling 3.2.3 library initialization complete
2025-03-20 13:31:51 INFO OpenSAML.Config : opensaml 3.2.1 library initialization complete
2025-03-20 13:31:51 INFO Shibboleth.Config : shibboleth 3.4.1 library initialization complete
2025-03-20 13:31:51 INFO Shibboleth.Config : loaded XML resource (/etc/shibboleth/shibboleth2.xml)
2025-03-20 13:31:51 INFO Shibboleth.Config : Shibboleth SP Version 3.4.1
2025-03-20 13:31:51 INFO Shibboleth.Config : Library versions: log4shib 2.0.1, Xerces-C 3.2.4, XML-Security-C 2.0.4, XMLTooling-C 3.2.3, OpenSAML-C 3.2.1, Shibboleth 3.4.1

OpenSSL 3.0.15 3 Sep 2024

Working old versions (Debian11)
-------------------------------------------------------
(unfortuinately doesn't log as nicely)
XMLTooling 3.2.0
OpenSAML 3.2.0
Shibboleth 3.2.2
OpenSSL 1.1.1k  25 Mar 2021

Thanks,
-Jon

-- 
Jonathan Proulx (he/him)
Sr. Technical Architect
The Infrastructure Group
MIT CSAIL