Red Hat Bugzilla – Bug 1353714
If a cipher is disabled, do not attempt to look it up
Last modified: 2016-11-03 16:43:56 EDT
Description of problem: Description: Even if a SSL cipher is disabled the server still attempts to locate the cipher in the security library. If the disabled cipher is unknown it logs a warning ast server startup, but if it's disabled there is no reason to check if it exists. https://fedorahosted.org/389/ticket/48743
Fixed upstream
Build tested: 389-ds-base-1.3.5.10-5.el7.x86_64 Verification steps: 1. Setup RHDS 2. Enable SSL/TLS as per the Admin Guide sec. 7.4 using the Admin Console 3. Use the default ciphers as part of the SSL/TLS enablement (fortezza family is enabled) 4. Check errors log for SSL alert about fortezza: [root@rhel-dev slapd-rhel-dev]# grep fortezza /var/log/dirsrv/slapd-rhel-dev/errors [29/Jul/2016:15:57:44.470979041 +0200] SSL alert: Cipher suite fortezza_null is not available in NSS 3.21. Ignoring fortezza_null [29/Jul/2016:15:57:44.504161610 +0200] SSL alert: Cipher suite fortezza is not available in NSS 3.21. Ignoring fortezza [29/Jul/2016:15:57:44.509658458 +0200] SSL alert: Cipher suite fortezza_rc4_128_sha is not available in NSS 3.21. Ignoring fortezza_rc4_128_sha 5. Disable fortezza family using the Admin Console 6. Check errors log for SSL alert about fortezza: [root@rhel-dev slapd-rhel-dev]# grep fortezza /var/log/dirsrv/slapd-rhel-dev/errors [root@rhel-dev slapd-rhel-dev]# echo $? 1 Result: server doesn't check for disabled ciphers. Marking as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2594.html