Bug 1584066
| Summary: | DS only accepts RSA and Fortezza cipher families [rhel-7.5.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | 389-ds-base | Assignee: | mreynolds |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> |
| Severity: | high | Docs Contact: | Marc Muehlfeld <mmuehlfe> |
| Priority: | high | ||
| Version: | 7.5 | CC: | enewland, mharmsen, mreynolds, msauton, nkinder, rmeggins |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.7.5-23.el7_5 | Doc Type: | Bug Fix |
| Doc Text: |
Due to a restriction in Directory Server, administrators could only use RSA and Fortezza ciphers. As a consequence, certificates created with a different cipher, such as ECC certificates, were not supported. This update removes this restriction. As a result, administrators can now use certificates with all ciphers supported by the underlying Network Security Services (NSS) database when configuring TLS in Directory Server.
|
Story Points: | --- |
| Clone Of: | 1582747 | Environment: | |
| Last Closed: | 2018-06-26 16:49:33 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1582747 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-05-30 08:02:42 UTC
Build tested: 389-ds-base-1.3.7.5-23.el7_5.x86_64
On a previous version I see the following errors when EC certificate is present in the database:
[13/Jun/2018:14:00:19.929317384 -0400] - WARN - Security Initialization - SSL alert: ConfigSecureServer: Server key/certificate is bad for cert Ser
ver-Cert of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8187 - security library: invalid arguments.)
[13/Jun/2018:14:00:19.929905435 -0400] - ERR - Security Initialization - SSL failure: None of the cipher are valid
[13/Jun/2018:14:00:19.930393165 -0400] - ERR - force_to_disable_security - ERROR: SSL2 Initialization Failed. Disabling SSL2.
# ss -ntpl | grep ns-slapd
LISTEN 0 128 :::389 :::* users:(("ns-slapd",pid=11338,fd=7))
After upgrade to 389-ds-base-1.3.7.5-23 I don't see errors anymore and TLS is initialized:
[13/Jun/2018:14:01:24.264253891 -0400] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2
# ss -ntpl | grep ns-slapd
LISTEN 0 128 :::636 :::* users:(("ns-slapd",pid=11467,fd=8))
LISTEN 0 128 :::389 :::* users:(("ns-slapd",pid=11467,fd=7))
Marking as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1988 |