Bug 1312491

Summary: NSSProtocol is ignored when NSSFIPS is enabled.
Product: Red Hat Enterprise Linux 7 Reporter: Matthew Harmsen <mharmsen>
Component: mod_nssAssignee: Matthew Harmsen <mharmsen>
Status: CLOSED ERRATA QA Contact: Kaleem <ksiddiqu>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.3CC: dpal, hokuda, ksiddiqu, rbost, rcritten, spoore
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: mod_nss-1.0.14-1.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1312052 Environment:
Last Closed: 2016-11-03 21:20:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1312052    
Bug Blocks:    

Comment 2 Scott Poore 2016-09-21 01:33:05 UTC 
Verified.

Version ::

mod_nss-1.0.14-5.el7.x86_64


Results ::

[root@vm3 conf.d]# grep -e FIPS -e TLSv /etc/httpd/conf.d/nss.conf
#   middle of a range may be excluded, the entry "NSSProtocol SSLv3,TLSv1.1"
#   is identical to the entry "NSSProtocol SSLv3,TLSv1.0,TLSv1.1".
#NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2
NSSProtocol TLSv1.2
NSSFIPS on

[root@vm3 conf.d]# systemctl restart httpd

[root@vm3 conf.d]# curl --tlsv1.0  https://vm3.example.com:8443/ 
curl: (35) Peer reports incompatible or unsupported protocol version.

[root@vm3 conf.d]# curl --tlsv1.1  https://vm3.example.com:8443/ 
curl: (35) Peer reports incompatible or unsupported protocol version.

[root@vm3 conf.d]# curl --tlsv1.2  https://vm3.example.com:8443/ 
PASS
Comment 4 errata-xmlrpc 2016-11-03 21:20:20 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2602.html