ciis0.github.io

Maven RHEL Algorithm constraints check failed on keysize limits: RSA 2048 bit key used with certificate error

I recently wanted to build a small Spring Boot utility and created a project using Spring Initializer. It worked all fine until I tried to use ./mvnw spring-boot:run, where the application failed with a quite confusing error (manually wrapped here):

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.22.2:test (default-test) on project spring-boot-config-resolver: 
    Execution default-test of goal org.apache.maven.plugins:maven-surefire-plugin:2.22.2:test failed:
    Plugin org.apache.maven.plugins:maven-surefire-plugin:2.22.2 or one of its dependencies could not be resolved:
    Failed to collect dependencies at org.apache.maven.plugins:maven-surefire-plugin:jar:2.22.2 -> org.apache.maven.surefire:maven-surefire-common:jar:2.22.2:
    Failed to read artifact descriptor for org.apache.maven.surefire:maven-surefire-common:jar:2.22.2:
    Could not transfer artifact org.apache.maven.surefire:maven-surefire-common:pom:2.22.2 from/to central (https://repo.maven.apache.org/maven2):
    transfer failed for https://repo.maven.apache.org/maven2/org/apache/maven/surefire/maven-surefire-common/2.22.2/maven-surefire-common-2.22.2.pom:
    PKIX path validation failed: java.security.cert.CertPathValidatorException:
    Algorithm constraints check failed on keysize limits: RSA 2048 bit key used with certificate: CN=GlobalSign Atlas R3 DV TLS CA H2 2021, O=GlobalSign nv-sa, C=BE -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginResolutionException

The strange part here is the Algorithm constraints check failed on keysize limits: RSA 2048 bit key used with certificate.

While researching the exception I found only errors regarding 1048 bit keys, but there was a hint to java.security file. So I checked mine, but on the first look only found the following, which limits keys below 2048 bits. Very confusing.

# $JAVA_HOME/conf/security/java.security
jdk.security.legacyAlgorithms=SHA1, \
    RSA keySize < 2048, DSA keySize < 2048

Going on with my very confused, I finally found a small hint: /etc/crypto-policies.

Checking there I found this:

$ cat /etc/crypto-policies/config
DEFAULT:MYCRYPTO1:NO-AES128

MYCRYPTO1 you may ask, and so did I. Seems to be the placeholder value used by this RHEL hardening guide (I was running this on a shared machine not set up by me but a collague). 5.7. Customizing system-wide cryptographic policies with policy modifiers

And there also is a /etc/crypto-policies/back-ends/java.config, which includes the following; note the RSA keySize < 3072 – this fits our error!

jdk.certpath.disabledAlgorithms=MD2, MD5, DSA, RSA keySize < 3072

But how does this get into JVM?

After some digging around I found a hint to security.useSystemPropertiesFile which is included in my java.security file, but I did not find it in Java documentation.

# $JAVA_HOME/config/security/java.security

#
# Determines whether this properties file will be appended to
# using the system properties file stored at
# /etc/crypto-policies/back-ends/java.config
#
security.useSystemPropertiesFile=true

Turns out to be a Fedora/RHEL patch!

https://src.fedoraproject.org/rpms/java-11-openjdk/blob/rawhide/f/pr3694-rh1340845-support_fedora_rhel_system_crypto_policy.patch

Whew; that was fun to look for.