PKCS12.xs:78: OpenSSL error, help?

[1clicc]

I'm really hitting a wall with a critical error on my PacketFence and could desperately use some help. I've been wrestling with this for what feels like weeks now.

The main problem is a captive portal failure during the SCEP enrollment process. When a device hits the portal, I consistently get this exception:

"Caught exception in captiveportal::Controller::Root->dynamic_application "PKCS12.xs:78: OpenSSL error: (null)" at /usr/local/pf/lib/pf/pki_provider/scep.pm line 111."

Anyone can point me to the write direction? I apologize if this is not the right place to ask for help. I followed the Installation Guide and re-read everything over and over in case I missed a step. Again I do apologize.

[vsl-iil]

Have you tried to enroll a certificate manually, like it's described in Debugging MSPKI Integration with PacketFence? If the second sscep command returns something along the lines of request payload encrypt failed and then something about DES-CBC, the possible solution is to edit lib/pf/pki_provider/scep.pm:107 to add another argument that specifies 3DES algorithm:

system("sscep", "enroll", "-c", $ca->[0],'-e', $ca->[1],"-k",$request->{key}, '-r', $request->{csr}, "-u",$self->url, '-S', 'sha1', '-l', $cert_path, "-E", "3des");

I'm yet to test it in the actual installation, but I tried to enroll a cert manually and it worked. I'll update the comment once I get a chance to test it properly.

[1clicc]

Have you tried to enroll a certificate manually, like it's described in Debugging MSPKI Integration with PacketFence? If the second sscep command returns something along the lines of request payload encrypt failed and then something about DES-CBC, the possible solution is to edit lib/pf/pki_provider/scep.pm:107 to add another argument that specifies 3DES algorithm:

system("sscep", "enroll", "-c", $ca->[0],'-e', $ca->[1],"-k",$request->{key}, '-r', $request->{csr}, "-u",$self->url, '-S', 'sha1', '-l', $cert_path, "-E", "3des");

I'm yet to test it in the actual installation, but I tried to enroll a cert manually and it worked. I'll update the comment once I get a chance to test it properly.

Yes, I have tried that and I believe it failed, but let me try running the debugging again and post it here once I have the time. Thanks.

[1clicc]

Below is the error I'm getting. I also added the the new code you provided me to the scep.pm file to line 107 with the same result. I'm not sure if I'm missing anything but any help will be highly appreciated. Thanks for your time.

sscep: request payload encrypt failed
40E77CA7C77F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (DES-CBC : 8), Properties ()
40E77CA7C77F0000:error:108C0100:PKCS7 routines:PKCS7_final:malloc failure:../crypto/pkcs7/pk7_smime.c:80:

[1clicc]

Sorry, I forgot to mention that I'm using MS SubCA PKI server and NDES SCEP with OCSP server services.

[vsl-iil]

I had a similar error, yes. Did you replace line 107 or added a new line? If you did replace it, does it return the same error? I replaced it and now it works just fine, I confirmed it yesterday.

[1clicc]

I had a similar error, yes. Did you replace line 107 or added a new line? If you did replace it, does it return the same error? I replaced it and now it works just fine, I confirmed it yesterday.

Yes, I replaced the whole 107 line to your provided code with same result. However, this time it generated a cert but failed on the encryption.

sscep: hexdump payload 692
sscep: request payload encrypt failed
40979063DD7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (DES-CBC : 8), Properties ()
40979063DD7F0000:error:108C0100:PKCS7 routines:PKCS7_final:malloc failure:../crypto/pkcs7/pk7_smime.c:80:

[jrouzierinverse]

Which version of Packetfence are you using?

[1clicc]

Which version of Packetfence are you using?

I"m using the Debain ISO v15