Bug 2157951
| Summary: | Support requiring EMS in TLS 1.2, default to it when in FIPS mode | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Hubert Kario <hkario> | |
| Component: | openssl | Assignee: | Dmitry Belyavskiy <dbelyavs> | |
| Status: | CLOSED ERRATA | QA Contact: | Hubert Kario <hkario> | |
| Severity: | medium | Docs Contact: | Mirek Jahoda <mjahoda> | |
| Priority: | medium | |||
| Version: | 9.0 | CC: | ahadas, anarnold, cllang, fhanzelk, joschrod, mjahoda, rjones, ssorce | |
| Target Milestone: | rc | Keywords: | Triaged, ZStream | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | openssl-3.0.7-16.el9 | Doc Type: | Enhancement | |
| Doc Text: |
.The `Extended Master Secret` TLS Extension is now enforced on FIPS-enabled systems
With the release of the link:https://access.redhat.com/errata/RHSA-2023:3722[RHSA-2023:3722] advisory, the TLS `Extended Master Secret` (EMS) extension (RFC 7627) is mandatory for TLS 1.2 connections on FIPS-enabled RHEL 9 systems. This is in accordance with FIPS-140-3 requirements. TLS 1.3 is not affected.
Legacy clients that do not support EMS or TLS 1.3 now cannot connect to FIPS servers running on RHEL 9. Similarly, RHEL 9 clients in FIPS mode cannot connect to servers that only support TLS 1.2 without EMS. This in practice means that these clients cannot connect to servers on RHEL 6, RHEL 7 and non-RHEL legacy operating systems. This is because the legacy 1.0.x versions of OpenSSL do not support EMS or TLS 1.3.
For more information, see link:https://access.redhat.com/solutions/7018256[TLS Extension "Extended Master Secret" enforced with Red Hat Enterprise Linux 9.2].
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 2188046 (view as bug list) | Environment: | ||
| Last Closed: | 2023-11-07 08:52:59 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2188046, 2218721 | |||
|
Description
Hubert Kario
2023-01-03 17:03:40 UTC
This change prevents connecting to VMware servers which stops all kinds of things such as backups and V2V conversions: bug 2218721 Requiring use of TLSv1.2 with EMS is a non-optional requirement for cryptographic modules certified under current FIPS 140-3. The solution is to upgrade the openssl used by VMware. The EMS extension was standardised 8 years ago (RFC7627). If for some reason they don't want to use EMS, they can also use TLSv1.3, which was standardised 5 years ago (RFC8446). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (openssl bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:6627 |