Red Hat Bugzilla – Bug 484101
Makefile for generating keys and certificates specifies less than the recommended number of bits
Last modified: 2009-07-03 10:01:14 EDT
Description of problem:
The file /etc/pki/tls/certs/Makefile specifies 1024 bits when generating the targets '%.pem' and '%.key', instead of the recommended minimum 2048 bits.
Version-Release number of selected component (if applicable):
$ rpm -qf /etc/pki/tls/certs/Makefile
Steps to Reproduce:
1. grep 1024 /etc/pki/tls/certs/Makefile
/usr/bin/openssl req $(UTF8) -newkey rsa:1024 -keyout $$PEM1 -nodes -x509 -days 365 -out $$PEM2 -set_serial $(SERIAL) ; \
/usr/bin/openssl genrsa -des3 1024 > $@
/usr/bin/openssl req $(UTF8) -newkey rsa:2048 -keyout $$PEM1 -nodes -x509 -days 365 -out $$PEM2 -set_serial $(SERIAL) ; \
/usr/bin/openssl genrsa -des3 2048 > $@
The recommended number of bits to be used when generating .pem and .key files is described in the OpenSSL document here:
"The number 2048 is the size of the key, in bits. Today, 2048 or
higher is recommended for RSA keys, as fewer amount of bits is
consider insecure or to be insecure pretty soon."
This might be a "Security Sensitive Bug." Please reset that flag if I am mistaken.
(In reply to comment #0)
> This might be a "Security Sensitive Bug." Please reset that flag if I am
That is used for non-public security vulnerabilities, while this is fairly public and more RFE actually.
Fixed in rawhide. To limit the number of updates in released Fedoras I will not do an update there just now. The admin can fix the problem manually there. If there will be update for other reasons I will add bug fix for this bug as well.