Description of problem: I have crypto policy set to future and when I try to use gnutls-cli, it fails with: Syntax error at: E_VERY_WEAK When crypto-policy is DEFAULT, I do not get this error. Version-Release number of selected component (if applicable): Name : crypto-policies Version : 20140905 Release : 1.git4649b7d.fc21 Architecture: noarch Steps to Reproduce: 1. set policy to FUTURE (and run update-crypto-policies) 2. try to use gnutls-cli Actual results: $ gnutls-cli -VVV -d 999 bugzilla.redhat.com |<2>| Initializing PKCS #11 modules |<2>| p11: Initializing module: p11-kit-trust |<2>| p11: Initializing module: gnome-keyring |<2>| p11: Initializing module: opensc |<3>| ASSERT: pkcs11.c:503 |<3>| ASSERT: pkcs11.c:2412 |<3>| ASSERT: pkcs11.c:2746 Processed 177 CA certificate(s). Resolving 'bugzilla.redhat.com'... Connecting to '209.132.183.69:443'... |<5>| REC[0x2098c70]: Allocating epoch #0 |<2>| selected priority string: NONE:+VERS-TLS1.2:+VERS-DTLS1.2:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:+SIGN-ALL:-SIGN-RSA-MD5:-SIGN-RSA-SHA1:-SIGN-DSA-SHA1:-SIGN-ECDSA-SHA1+CURVE-SECP256R1:+CURVE-SECP384R1:+CURVE-SECP521R1:+COMP-NULL:%PROFILE_MEDIUM |<3>| ASSERT: gnutls_priority.c:1388 Syntax error at: E_VERY_WEAK Additional info: $ cat /etc/crypto-policies/back-ends/gnutls.config SYSTEM=NONE:+VERS-TLS1.2:+VERS-DTLS1.2:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:+SIGN-ALL:-SIGN-RSA-MD5:-SIGN-RSA-SHA1:-SIGN-DSA-SHA1:-SIGN-ECDSA-SHA1+CURVE-SECP256R1:+CURVE-SECP384R1:+CURVE-SECP521R1:+COMP-NULL:%PROFILE_MEDIUM
Thanks. I see a typo in the string, although I see a different error code. Does replacing back-ends/gnutls.config with the following fixes the issue for you? "NONE:+VERS-TLS1.2:+VERS-DTLS1.2:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:+SIGN-ALL:-SIGN-RSA-MD5:-SIGN-RSA-SHA1:-SIGN-DSA-SHA1:-SIGN-ECDSA-SHA1:+CURVE-SECP256R1:+CURVE-SECP384R1:+CURVE-SECP521R1:+COMP-NULL:%PROFILE_MEDIUM"
$ cat /etc/crypto-policies/back-ends/gnutls.config NONE:+VERS-TLS1.2:+VERS-DTLS1.2:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:+SIGN-ALL:-SIGN-RSA-MD5:-SIGN-RSA-SHA1:-SIGN-DSA-SHA1:-SIGN-ECDSA-SHA1:+CURVE-SECP256R1:+CURVE-SECP384R1:+CURVE-SECP521R1:+COMP-NULL:%PROFILE_MEDIUM With this “gnutls-cli bugzilla.redhat.com” works. $ cat /etc/crypto-policies/back-ends/gnutls.config SYSTEM=NONE:+VERS-TLS1.2:+VERS-DTLS1.2:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:+SIGN-ALL:-SIGN-RSA-MD5:-SIGN-RSA-SHA1:-SIGN-DSA-SHA1:-SIGN-ECDSA-SHA1:+CURVE-SECP256R1:+CURVE-SECP384R1:+CURVE-SECP521R1:+COMP-NULL:%PROFILE_MEDIUM With this “gnutls-cli bugzilla.redhat.com” returns: - Status: The certificate is NOT trusted. The certificate chain uses insecure algorithm. but some other sites work. Which one is correct?
Correct, that seems to fix the issue then. Note that with future settings you shouldn't expect many sites to work. Among others, it requires better than SHA1 algorithms, and most sites on the internet don't use anything else than SHA1. With the openssl settings it is not possible to express this requirement (hopefully that will change in F22), and that's why it may work.
crypto-policies-20140905-2.git4649b7d.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/crypto-policies-20140905-2.git4649b7d.fc21
Package crypto-policies-20140905-2.git4649b7d.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing crypto-policies-20140905-2.git4649b7d.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-17120/crypto-policies-20140905-2.git4649b7d.fc21 then log in and leave karma (feedback).
crypto-policies-20140905-2.git4649b7d.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.