Description of problem: The file /etc/pki/tls/certs/Makefile specifies 1024 bits when generating the targets '%.pem' and '%.key', instead of the recommended minimum 2048 bits. Version-Release number of selected component (if applicable): $ rpm -qf /etc/pki/tls/certs/Makefile openssl-0.9.8g-12.fc10.x86_64 How reproducible: "Always." Steps to Reproduce: 1. grep 1024 /etc/pki/tls/certs/Makefile 2. 3. Actual results: /usr/bin/openssl req $(UTF8) -newkey rsa:1024 -keyout $$PEM1 -nodes -x509 -days 365 -out $$PEM2 -set_serial $(SERIAL) ; \ /usr/bin/openssl genrsa -des3 1024 > $@ Expected results: /usr/bin/openssl req $(UTF8) -newkey rsa:2048 -keyout $$PEM1 -nodes -x509 -days 365 -out $$PEM2 -set_serial $(SERIAL) ; \ /usr/bin/openssl genrsa -des3 2048 > $@ Additional info: The recommended number of bits to be used when generating .pem and .key files is described in the OpenSSL document here: http://www.openssl.org/docs/HOWTO/keys.txt "The number 2048 is the size of the key, in bits. Today, 2048 or higher is recommended for RSA keys, as fewer amount of bits is consider insecure or to be insecure pretty soon." This might be a "Security Sensitive Bug." Please reset that flag if I am mistaken.
(In reply to comment #0) > This might be a "Security Sensitive Bug." Please reset that flag if I am > mistaken. That is used for non-public security vulnerabilities, while this is fairly public and more RFE actually.
Fixed in rawhide. To limit the number of updates in released Fedoras I will not do an update there just now. The admin can fix the problem manually there. If there will be update for other reasons I will add bug fix for this bug as well.