Bug 1160468 - support TLS 1.1 and later
Summary: support TLS 1.1 and later
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openldap
Version: 7.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Jan Synacek
QA Contact: Eduard Benes
Depends On: 1160466 1160467 1164889
Blocks: 746646
TreeView+ depends on / blocked
Reported: 2014-11-04 21:42 UTC by Rich Megginson
Modified: 2020-09-13 21:14 UTC (History)
17 users (show)

Fixed In Version: openldap-2.4.39-4.el7
Doc Type: Enhancement
Doc Text:
Feature: TLS 1.1 and later has been added. Reason: To support latest secure transport. Result: TLS 1.1 and later is now supported.
Clone Of: 1160467
Last Closed: 2015-03-05 13:35:39 UTC
Target Upstream Version:

Attachments (Terms of Use)
patch that was submitted to openldap (1.53 KB, patch)
2014-11-12 19:47 UTC, mreynolds
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 1272 0 None None None 2020-09-13 21:14:43 UTC
OpenLDAP ITS 7979 0 None None None Never
Red Hat Bugzilla 1154104 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Product Errata RHBA-2015:0597 0 normal SHIPPED_LIVE openldap bug fix and enhancement update 2015-03-05 17:20:57 UTC

Internal Links: 1154104

Description Rich Megginson 2014-11-04 21:42:53 UTC
+++ This bug was initially created as a clone of Bug #1160467 +++

+++ This bug was initially created as a clone of Bug #1160466 +++

Description of problem:
I don't believe tls_m.c supports TLS 1.1 and later.  This requires some additional NSS APIs.  You should be able to tell openldap to support TLS protocols > 1.0 with TLS_PROTOCOL_MIN

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

Actual results:

Expected results:

Additional info:

--- Additional comment from Rich Megginson on 2014-11-04 16:41:22 EST ---

This needs to go into all versions of Fedora ASAP.  Should I clone this for all Fedora releases?

Comment 3 mreynolds 2014-11-12 19:47:02 UTC
Created attachment 956859 [details]
patch that was submitted to openldap

Comment 4 mreynolds 2014-11-12 19:52:13 UTC
Patch has been submitted to openldap (ITS#7979)

Comment 6 Sankar Ramalingam 2014-11-18 06:51:45 UTC
This is blocking 389-ds-base to be tested with latest versions of TLS1.1, TLS1.2 and above. Hence, marking this as testBlocker

Comment 15 Rik Theys 2015-01-22 12:44:52 UTC

This change has already been implemented in Fedora 21 and resulted in another (unrelated) bug: see bugzilla 1172638 for my bug report against Fedora 21.

It seems when the openldap server has olcTLSVerifyClient set to 'allow' this patch breaks TLS 1.1+ connections to that server.

I've also filed OpenLDAP ITS 8002 in the upstream bug tracker for this.

Hopefully this issue can be fixed before RHEL 7.1 (or 6.7) is released.



Comment 21 errata-xmlrpc 2015-03-05 13:35:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.