Bug 1071615
| Summary: | openssl in rawhide fails to parse certain certs, whereas openssl in F-20 does | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Hans de Goede <hdegoede> |
| Component: | openssl | Assignee: | Tomas Mraz <tmraz> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | mads, redhat-bugzilla, tmraz, tomek |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-03-03 14:01:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
OpenSSL in Rawhide does not support MD5 signatures in certificates as these possess significant security risk. For those like me who also spent a lot of time with messing with RPM Fusion's MD5 signatures in certificates: "OPENSSL_ENABLE_MD5_VERIFY=1 make build" It can also be worked around on runtime: OPENSSL_ENABLE_MD5_VERIFY=1 openssl verify -CAfile ca.crt my.crt I guess that should go to the f21 faq and have a prominent place in the upgrade notes. I have however not found a way to apply that when I am on the openvpn client side and only have a md5 cert that my client side refuse to send to the server. |
When trying to build some packages for rpmfusion using plague-client I get the following error: OpenSSL.SSL.Error: [('asn1 encoding routines', 'ASN1_item_verify', 'unknown message digest algorithm'), ('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')] Since things work in F-20 I started with downgrading my openssl packages to: openssl-1.0.1e-37.fc21.x86_64.rpm openssl-devel-1.0.1e-37.fc21.x86_64.rpm openssl-libs-1.0.1e-37.fc21.i686.rpm openssl-libs-1.0.1e-37.fc21.x86_64.rpm Which are the rawhide equivalent of the latest pkgs in F-20, which do work. Downgrading to these versions did *not* fix my issues. However downgrading to: openssl-1.0.1e-37.fc20.x86_64.rpm openssl-devel-1.0.1e-37.fc20.x86_64.rpm openssl-libs-1.0.1e-37.fc20.i686.rpm openssl-libs-1.0.1e-37.fc20.x86_64.rpm Does fix my issue, so it seems that something in the rawhide build-root causes openssl in rawhide to miss support for certain mda-s. The server using the troublesome cert can be found here: https://buildsys.rpmfusion.org:8887