Created attachment 1002075 [details] Patch for tqsllib Description of problem: As of Fedora 21, the OpenSSL libraries have been modified to disable certain signature algorithms. Attempts by tqsl to verify certificates from ARRL LoTW, which are signed using MD5, are rejected by the OpenSSL library bundled with Fedora 21+. Unlike the SSL/TLS cipher suite disables, which have a system configuration file that enables DEFAULT/LEGACY/FUTURE ciphersuite selection, there is no configuration file that allows a user to override disabling the use of MD5 signatures. To allow tqsl to work properly, something must set environment variable OPENSSL_ENABLE_MD5_VERIFY. The attached tqsllib patch will add the required environment variable. Version-Release number of selected component (if applicable): How reproducible: Try to import a TQ6 file created by LoTW. Steps to Reproduce: 1. Start TQSL 2. Callsign Certificate/Load Callsign Certificate From File 3. Select an existing .TQ6 file 4. Observe (poorly) reported "certificate signature failure" Actual results: "certificate signature failure" Expected results: "no error"
I have submitted a help desk ticket with ARRL LoTW. I don't have high hopes but let's see what they say before implementing the workaround.
What can ARRL LoTW do here? Replace every user certificate so that users can work around this incompatibility? That's nonsense. I've asked already for LoTW to consider moving to a more robust hash algorithm. That's a quite reasonable request, in my opinion. That's fine for the future, but we can't force thousands of users to request renewals just to get certificates that work with Fedora. I've checked in the workaround to the upstream (see the attached patch). And let the LoTW help desk know to tell people having this issue how to fix it with an addition to their .bashrc. Ingest the patch, and you should be OK. If the Fedora project chooses to bury the consequences of these poorly informed changes to Fedora, ignoring the impact of disabling what are generally acceptable algorithms, then please rename your libraries to something distribution-specific as what you are shipping is NOT OpenSSL.
Forgot to add this bug to the bodhi update, closing.