Bug 2526328 - stunnel re-generates DH parameters every 24 hours in DEFAULT crypto-policy
Summary: stunnel re-generates DH parameters every 24 hours in DEFAULT crypto-policy
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora
Classification: Fedora
Component: stunnel
Version: 44
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
Assignee: Clemens Lang
QA Contact: Fedora Extras Quality Assurance
URL: https://www.stunnel.org/mailman3/hype...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-31 14:44 UTC by Clemens Lang
Modified: 2026-08-31 14:46 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:
fedora-admin-xmlrpc: mirror+

Attachments (Terms of Use)

Description Clemens Lang 2026-08-31 14:44:22 UTC 
Because the DEFAULT crypto-policy enables FFDHE, and we patch stunnel to use PROFILE=SYSTEM, stunnel sees FFDHE is enabled and chooses to generate new Diffie-Hellman parameters every 24 hours, which takes a lot of CPU time.

Ideally, stunnel could just use the well-known groups from RFC 7919 instead.

Reproducible: Always

Steps to Reproduce:
1. start an stunnel instance
2. observe CPU usage due to DH parameter generation

Actual Results:
High CPU usage

Expected Results:
No CPU usage for DH parameter generation
Note You need to log in before you can comment on or make changes to this bug.