Bug 1333515 - Enable DS to offer weaker DH params in NSS
Summary: Enable DS to offer weaker DH params in NSS
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-05-05 17:24 UTC by Noriko Hosoi
Modified: 2016-11-03 20:41 UTC (History)
4 users (show)

Fixed In Version: 389-ds-base-1.3.5.3-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-03 20:41:51 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2594 normal SHIPPED_LIVE Moderate: 389-ds-base security, bug fix, and enhancement update 2016-11-03 12:11:08 UTC

Description Noriko Hosoi 2016-05-05 17:24:51 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/48798

Certain client applications, especially java may crash with the following:

{{{
javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair
}}}

This affects java 1.6.0 and 1.7.0.

When nss upgrades to 2.21, it enables DH in ciphers. By default the smallest DH param size is 2048 bits.

However, java 1.6.0 and 1.7.0 can only accept up to 1024 bit params.

DS should have the option, to set NSS to offer smaller (weaker) param sizes for compatibility with older clients.

Comment 2 Simon Pichugin 2016-07-15 05:18:34 UTC
Build tested:
389-ds-base-1.3.5.10-5.el7.x86_64

=========================== test session starts ===========================
platform linux2 -- Python 2.7.5, pytest-2.9.2, py-1.4.31, pluggy-0.3.1 -- /usr/bin/python
cachedir: dirsrvtests/tests/tickets/.cache
rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests/tests/tickets, inifile:
plugins: html-1.9.0, cov-2.3.0
collected 1 items

dirsrvtests/tests/tickets/ticket48798_test.py::test_ticket48798 PASSED

======================== 1 passed in 37.11 seconds ========================

Marking as verifed.

Comment 4 errata-xmlrpc 2016-11-03 20:41:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2594.html


Note You need to log in before you can comment on or make changes to this bug.