Hello, upgrading from 3.4 to 3.5, I am facing the following issue
JWT Authentication
[PASS] The JWT Authentication plugin is enabled
[PASS] The /etc/passbolt/jwt/ directory is not writable.
[FAIL] A valid JWT key pair is missing
[HELP] Run the create JWT keys script to create a valid JWT secret and public key pair:
[HELP] sudo su -s /bin/bash -c â/usr/share/php/passbolt/bin/cake passbolt create_jwt_keysâ www-data
[FAIL] 1 error(s) found. Hang in there!
$ sudo su -s /bin/bash -c â/usr/share/php/passbolt/bin/cake passbolt create_jwt_keysâ www-data
The JWT private key could not be created.
Can you provide guidance to let me create this JWT key ?
Thank you @garrett for your interest ! Unfortunately, it does not work after having checked and try various permissions (see my log below)
Actually I am confused because the healthcheck about /etc/passbolt/jwt says âPASSâ (checking the directory is NOT writable (for security purposes I think).
> # sudo chown -R www-data:www-data /etc/passbolt/jwt
> # sudo chmod 755 /etc/passbolt/jwt
> # sudo chmod 600 /etc/passbolt/jwt/jwt.key
> # sudo chmod 644 /etc/passbolt/jwt/jwt.pem
> # sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt create_jwt_keys" www-data
>
> Public key path: /etc/passbolt/jwt/jwt.pem
> Secret key path: /etc/passbolt/jwt/jwt.key
> A JWT key pair was found.
> Use the force option to overwrite with a fresh new pair.
> This will log out all users currently logged in with JWT Authentication.
>
> # sudo su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt create_jwt_keys --force" www-data
>
> The JWT private key could not be created.
Notice : Iâve got those other failures in healtchecks since the beginning of passbolt (at least the v2) but it never prevented the whole system working correctly, with many clients and users, so I donât think the jwt generation error is related (probably the healtcheck does not trust my private CA and/or my wildcard cert)
[FAIL] Could not reach the /healthcheck/status with the url specified in App.fullBaseUrl**
[FAIL] SSL peer certificate does not validate
[FAIL] Hostname does not match when validating certificates
Another notice : creation (touch) of empty jwt.key and jwt.pem do not solve the problem (create_jwt_key --force still fails) AND breaks the system (the client says : internal error has occured).
Isnât there a way to enable detailed error log for cake create_jwt_keys ?
{"header":{"id":"c1e96a3e-40ef-4c8d-b2a7-18c0cbf3ade1","status":"success","servertime":1642846590,"action":"2a80ca92-0e47-5780-b338-3568f3cff69e","message":"L\u0027op\u00e9ration a \u00e9t\u00e9 effectu\u00e9e avec succ\u00e8s.","url":"\/auth\/jwt\/rsa.json","code":200},"body":{"keydata":"-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyWFI+aGg4qpK6rJw6s1Z\n9KwnilZvXaIl+Fd7xIV1ycssc7IZrVqeYwcuzGamB1tQ8i5R5Hqc9161JPSvC6PD\n0nrXQhyLz2\/PxD6jbs8Ulg5hsSv968c1CAW0of6RIb9Lbq3Ur4f8K1qvwrfB6NN8\nTNOAs8FbVVq8W1\/9hSUtDe7r8QJk+BUj\/1CXKFcarcolFAXypGvqWEr1LQRiqzuN\nVDstopONGZXcDE1WNWvwkds3pCOhYOo0W7Z9ufkkaXJ53dVSTfxrNRw+NYAIc6NT\n2wcBiPWRdFp3vZvTpNHqKZg17RyPgwzALpPQOMN5W2auoaEs5dHEVEwVo0kciBKM\niSRewPo1egu3+TfvuuINq8gU3v6LhsXHlVqsnNVFgivotePy\/oCg3mPIaQTf9xVe\nTW3u+XW\/c2A\/KSxf5Lpc0cT\/hUPfABPnxQBLCMyTGGihC0eOc1TldoOMMPEv214J\n7u7KcPIoJ6O+34K1r4VHjQscCtRfeND7qznFqckl1hJhyXV3iYz3ys3NnNCGZDz5\nTvf6B1hVovzQO8lqt7JLX0j0+HDe3CncTVjpLSkoTGv8e2gDKOs\/aSFRBwOlU\/QZ\nBrKrQPIXwpryMoM\/HdTqtUY0So4Edq9uiatU8Kvf3VaY6oMvQGrLI6WG9g7g71ZI\nOvZx3R1edAtYSu1Wy5nXScsCAwEAAQ==\n-----END PUBLIC KEY-----\n"}}
Thanks @jc but it get stuck at the second step of the doc so I cannot go further
sudo /usr/share/php/passbolt/bin/cake passbolt create_jwt_keys
The JWT private key could not be created.
and the folder remains empty :
ls -la /etc/passbolt/jwt/
total 8
drwxr-x--- 2 root www-data 4096 Jan 22 11:45 .
drwxr-x--- 7 root www-data 4096 Jan 22 11:45 ..
Wouldnât it be possible that the create_jwt_keys primitive miss some kind of dependency that was forgotten in the 3.5 migration script ? I was safely waiting for the stable release and did not do anything during the betaâŚ
Thanks, this was exactly the pointer to the good code snippet I was looking for !
It told me the failing function was âopenssl_pkey_newâ. Googling around, I found that âYou need to have a valid openssl.cnf installed for this function to operate correctlyâ.
On my - pretty standard I think - Debian system, I had no /etc/ssl/openssl.cnf file.
solved the problem : create_jwt_keys now terminates correctly.
Thanks again @garrett and @AnatomicJC . Passbolt is a so beautiful software, and this community a pleasant place
NB : by the way, creating /etc/ssl/openssl.cnf also solved the three other errors (see my previous post) the healthchecks have been reporting for two or three years
Yes, I would like to see your ssl config because of the failing openssl_pkey_new function. I thought ssl was disabled somewhere in php.uni but it was elsewhere
It is great we manage to find the solution all together
It was a very interesting case, enjoy the mobile app
For clarity for any other Debian user : my brand new /etc/ssl/openssl.cnf config file is a quite long one (362 lines) beginning by the lines below.
There is absolutely nothing particular or customised by myself, just a copy of the one shipped by debian in /etc/ssl/openssl.cnf.dpkg-dist
> #
> # OpenSSL example configuration file.
> # This is mostly being used for generation of certificate requests.
> #
>
> # Note that you can include other files from the main configuration
> # file using the .include directive.
> #.include filename
>
> # This definition stops the following lines choking if HOME isn't
> # defined.
> HOME = .
>
> # Extra OBJECT IDENTIFIER info:
> #oid_file = $ENV::HOME/.oid
> oid_section = new_oids
>
> # System default
> openssl_conf = default_conf
>
> # To use this configuration file with the "-extfile" option of the
> # "openssl x509" utility, name here the section containing the
> # X.509v3 extensions to use:
> # extensions =
> # (Alternatively, use a configuration file that has only
> # X.509v3 extensions in its main [= default] section.)
>
> [ new_oids ]
>
> # We can add new OIDs in here for use by 'ca', 'req' and 'ts'.
> # Add a simple OID like this:
> # testoid1=1.2.3.4
> # Or use config file substitution like this:
> # testoid2=${testoid1}.5.6
>
> # Policies used by the TSA examples.
> tsa_policy1 = 1.2.3.4.1
> tsa_policy2 = 1.2.3.4.5.6
> tsa_policy3 = 1.2.3.4.5.7
I read in other topics you are using package on Debian, right ? Which Debian name and version are you using (cat /etc/os-release) ?
