Bug 637525
| Summary: | If your certificate key size greater than 512 bits a stepdown key will be generated, this can't be swithed off from mod_nss | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Wolter Eldering <wolter.eldering> | ||||
| Component: | mod_nss | Assignee: | Rob Crittenden <rcritten> | ||||
| Status: | CLOSED WONTFIX | QA Contact: | Chandrasekar Kannan <ckannan> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 5.4 | CC: | benl, dpal | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 719403 (view as bug list) | Environment: | |||||
| Last Closed: | 2011-07-06 17:56:24 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 719403 | ||||||
| Attachments: |
|
||||||
The patch will be accepted upstream and will be delivered as a version that will be included into RHEL7. This issue will not be addressed in RHEL 5.x. |
Created attachment 449710 [details] Patch adding NSSNoStepDown (on|off) config option Description of problem: If your certificate key size greater than 512 bits a 512 bit key-pair is generated on the fly for every ssl server. This takes considerable time and maybe the use of a 512 bit key might be unwanted. Version-Release number of selected component (if applicable): 1.0.8 How reproducible: Create Certificate with key size bigger than 512. Steps to Reproduce: 1. Load/Create 1024bit certificate into certificate database 2. Put export NSS_DEBUG_PKCS11_MODULE="NSS Internal PKCS #11 Module" to get timing information (debug build nss) 3. service start httpd Actual results: Starting httpd: Function # Calls Time Avg. % Time --8<-- C_GenerateKeyPair 1 53ms 53000.00us 3.77% --8<-- Expected results: No call to C_GenerateKeyPair and stepdown key disabled in NSS Additional info: