Red Hat Bugzilla – Bug 1333515
Enable DS to offer weaker DH params in NSS
Last modified: 2016-11-03 16:41:51 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/48798 Certain client applications, especially java may crash with the following: {{{ javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair }}} This affects java 1.6.0 and 1.7.0. When nss upgrades to 2.21, it enables DH in ciphers. By default the smallest DH param size is 2048 bits. However, java 1.6.0 and 1.7.0 can only accept up to 1024 bit params. DS should have the option, to set NSS to offer smaller (weaker) param sizes for compatibility with older clients.
Build tested: 389-ds-base-1.3.5.10-5.el7.x86_64 =========================== test session starts =========================== platform linux2 -- Python 2.7.5, pytest-2.9.2, py-1.4.31, pluggy-0.3.1 -- /usr/bin/python cachedir: dirsrvtests/tests/tickets/.cache rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests/tests/tickets, inifile: plugins: html-1.9.0, cov-2.3.0 collected 1 items dirsrvtests/tests/tickets/ticket48798_test.py::test_ticket48798 PASSED ======================== 1 passed in 37.11 seconds ======================== Marking as verifed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2594.html