[similarly with curl, this is to make sure that crypto policies support is operational even when openldap is linked with openssl] Please convert to use the system's crypto policy for SSL and TLS: https://fedoraproject.org/wiki/Packaging:CryptoPolicies If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority(). If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM". In both cases please verify that the application uses the system's crypto policies. If the package is already using the system-wide crypto policies, or it does not use SSL or TLS, no action is required, the bug can simply be closed.
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'.
Hello Nikos, nowadays we use OpenSSL for crypto. For OpenLDAP, there is an option to set the ciphers, however these are set only if explicitly set in a configuration file. By default the configuration files do not mention almost any options (apart from those that are different from upstream default) which is also the case of the option to set the ciphers. All the options are of course documented in according man pages. Given the above and me inclining to not mention explicitly an implicit option value, I guess there is no need to do any change to openldap component. Does this reasoning align with the system-wide crypto policies recommended implementation? I am asking because the spelling of the documentation for system-wide crypto policies does not explicitly mention the case OpenLDAP has - the option is there but it is not shipped in default configuration files. Thanks for clarification!
Hi Matus, if there is a default config, I'd make sure that any ciphers are commented out, with a small comment that this is the recommended way in order to use the system-wide settings.
Thanks for the feedback, Nikos. I've done so: https://src.fedoraproject.org/rpms/openldap/c/81afb5768a29e7c033514860da6e25d3d9242d24?branch=f28
Thank you
Closing as CURRENTRELEASE, as the change has been in for quite some time already (see Fixed In Version of this bug).