Bug 2526328

Summary: stunnel re-generates DH parameters every 24 hours in DEFAULT crypto-policy
Product: [Fedora] Fedora Reporter: Clemens Lang <cllang>
Component: stunnelAssignee: Clemens Lang <cllang>
Status: ASSIGNED --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: medium    
Version: 44CC: crypto-team, ngompa13, shebburn, tm
Target Milestone: ---Keywords: Triaged
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: All   
OS: Linux   
URL: https://www.stunnel.org/mailman3/hyperkitty/list/stunnel-users@lists.stunnel.org/thread/JO3YRXAT33WOVDL3VUFJOV7PUXQ2KLPS/
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Clemens Lang 2026-08-31 14:44:22 UTC 
Because the DEFAULT crypto-policy enables FFDHE, and we patch stunnel to use PROFILE=SYSTEM, stunnel sees FFDHE is enabled and chooses to generate new Diffie-Hellman parameters every 24 hours, which takes a lot of CPU time.

Ideally, stunnel could just use the well-known groups from RFC 7919 instead.

Reproducible: Always

Steps to Reproduce:
1. start an stunnel instance
2. observe CPU usage due to DH parameter generation

Actual Results:
High CPU usage

Expected Results:
No CPU usage for DH parameter generation