Cause: The httpd daemon fails to start when FIPS mode is enabled when it attempts to create a temporary RSA key.
Consequence: httpd cannot be used in FIPS mode.
Workaround (if any): Disable FIPS mode when using httpd.
Result:
Description of problem:
There's a new version of openssl in development, which breaks EWS2 on RHEL6. Both tomcat nor httpd are not able able to start.
Version-Release number of selected component (if applicable):
openssl-1.0.1e-16.el6_5.9
How reproducible:
100%
Steps to Reproduce:
1. get a RHEL6 box
2. install openssl-1.0.1e-16.el6_5.9
3. install EWS2 (zip)
4. start tomcat||httpd
Comment 6Jean-frederic Clere
2014-06-03 15:09:14 UTC
I have tried with
http://download.devel.redhat.com/devel/candidates/JBEWS/2.1.0.ER1/
++++
[jfclere@neo3 ~]$ rpm -qa | grep openssl
openssl-devel-1.0.1e-16.el6_5.4.x86_64
openssl-1.0.1e-16.el6_5.4.x86_64
++++
Works OK.
Update openssl (yum update openssl):
++++
[jfclere@neo3 tomcat6]$ rpm -qa | grep openssl
openssl-1.0.1e-16.el6_5.7.x86_64
openssl-devel-1.0.1e-16.el6_5.7.x86_64
+++
It seems openssl-1.0.1e-16.el6_5.9 isn't available yet... According to the errata it causes regressions.
Comment 8Jean-frederic Clere
2014-06-04 14:52:59 UTC
After quick investigation the fixes in both tomcat-native and httpd are similar in ssl_tmp_key_init_rsa().
- if (FIPS_mode() && bits < 1024) {
+ if (FIPS_mode() && bits < 2048) {
The side effect is that we won't have temporary RSA keys any more.
Comment 9Jean-frederic Clere
2014-06-05 05:58:11 UTC
According to Joe we need a bigger patch he is working on it.
Comment 10Jean-frederic Clere
2014-06-17 06:21:01 UTC