Bug 668590
| Summary: | Could not negotiate a supported cipher suite. | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jóhann B. Guðmundsson <johannbg> | ||||||||||
| Component: | gnutls | Assignee: | Tomas Mraz <tmraz> | ||||||||||
| Status: | CLOSED CANTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | low | ||||||||||||
| Version: | 6.0 | CC: | pknirsch, prc, pvrabec, thind_ranbir | ||||||||||
| Target Milestone: | rc | ||||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2013-04-04 12:51:35 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Jóhann B. Guðmundsson
2011-01-10 20:46:31 UTC
Created attachment 472684 [details]
/etc/cups/cupsd.conf
Created attachment 472685 [details]
/var/log/cups/error.log
Created attachment 472686 [details]
openssl test
Created attachment 472687 [details]
gnutls test
CUPS uses gnutls, yes. It seems like this is a gnutls issue with that certificate, as you say.
It looks like that message is coming from here:
gnutls_certificate_allocate_credentials(credentials);
gnutls_certificate_set_x509_key_file(*credentials, ServerCertificate,
ServerKey, GNUTLS_X509_FMT_PEM);
gnutls_init(&con->http.tls), GNUTLS_SERVER);
gnutls_set_default_priority(con->http.tls);
gnutls_credentials_set(con->http.tls, GNUTLS_CRD_CERTIFICATE, *credentials);
gnutls_transport_set_ptr(con->http.tls, (gnutls_transport_ptr)HTTP(con));
gnutls_transport_set_pull_function(con->http.tls, _httpReadGNUTLS);
gnutls_transport_set_push_function(con->http.tls, _httpWriteGNUTLS);
error = gnutls_handshake(con->http.tls);
if (error != GNUTLS_E_SUCCESS)
{
cupsdLogMessage(CUPSD_LOG_ERROR,
"Unable to encrypt connection from %s - %s",
con->http.hostname, gnutls_strerror(error));
[...]
Changing component.
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative. What does that answer actually mean? Does it mean that this bug wont get fixed during the lifecycle of RHEL6? No, this means just that it will not be fixed in RHEL 6.2. This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative. Can you please provide an example of such certificate? Also I suppose it might be duplicate of bug 745242 - is the private key encoded in the PKCS#8 format? Can you try to convert it with the 'openssl rsa' command to the PKCS#1 format and see if that helps. This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. Unfortunately we cannot fix the bug due to missing information. As Tomas Mraz suggested above, I was able to get this working by converting the PKCS#8 private key to PKCS#1 private key using "openssl rsa". Thank you Tomas for valuable suggestion. |