Skip to content

Commit

Permalink
tls: Stop hardcoding 2048 bit RSA key length
Browse files Browse the repository at this point in the history
These are rejected as "too weak" by the "FUTURE" crypto policy. Let the
tools decide about appropriate defaults rather.

Thanks to Renaud Métrich for finding this!

https://issues.redhat.com/browse/RHEL-78645
  • Loading branch information
martinpitt committed Feb 11, 2025
1 parent 3ea4f53 commit c3a64be
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions src/tls/cockpit-certificate-helper.in
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ install_key() {
selfsign_sscg() {
sscg --quiet \
--lifetime "${DAYS}" \
--key-strength 2048 \
--cert-key-file "${KEYFILE}" \
--cert-file "${CERTFILE}" \
--ca-file "${CA_FILE}" \
Expand All @@ -43,7 +42,7 @@ selfsign_sscg() {
selfsign_openssl() {
openssl req -x509 \
-days "${DAYS}" \
-newkey rsa:2048 \
-newkey rsa \
-keyout "${KEYFILE}" \
-keyform PEM \
-nodes \
Expand Down

0 comments on commit c3a64be

Please sign in to comment.