+++ This bug was initially created as a clone of Bug #2106043 +++ MS-PKCA v20211006 (section 2.2)[1] defines the following supported algorithms for PKINIT CMS signature: * md5WithRSAEncryption (since Windows Server 2003) * sha1WithRSAEncryption (newer than Windows Server 2003) * ecdsa-with-sha1/256/384/512 (newer than Windows Server 2008) Out of this list, ECDSA signatures are the only ones that are still allowed to verify on RHEL9 (SHA-1 and MD5 signatures verification is disallowed by default). We should implement RFC5349[2] in MIT krb5 in order to support PKINIT pre-authentication against Active Directory. [1] https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-PKCA/%5bMS-PKCA%5d.pdf [2] https://www.rfc-editor.org/rfc/rfc5349.html
FEDORA-2023-5cd7789569 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-5cd7789569
This was added to krb5 1.21 update by mistake, this work is not completed yet.
FEDORA-2025-51a9c78142 (krb5-1.21.3-5.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-51a9c78142
FEDORA-2025-51a9c78142 (krb5-1.21.3-5.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-3e5228ee23 (krb5-1.21.3-4.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-3e5228ee23
FEDORA-2025-61b9344baf (krb5-1.21.3-3.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2025-61b9344baf
FEDORA-2025-3e5228ee23 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-3e5228ee23` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-3e5228ee23 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-61b9344baf has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-61b9344baf` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-61b9344baf See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-3e5228ee23 (krb5-1.21.3-4.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-61b9344baf (krb5-1.21.3-3.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.