Resolves: rhbz#1975836 Signed-off-by: Sahana Prasad <sahana@redhat.com>epel8
Sahana Prasad
3 years ago
parent
03899fca38
commit
49de59749c
@ -0,0 +1,67 @@
|
||||
diff -up openssl-3.0.0-beta2/apps/openssl.cnf.legacy-prov openssl-3.0.0-beta2/apps/openssl.cnf
|
||||
--- openssl-3.0.0-beta2/apps/openssl.cnf.legacy-prov 2021-08-16 14:02:48.029645419 +0200
|
||||
+++ openssl-3.0.0-beta2/apps/openssl.cnf 2021-08-16 14:14:48.006409467 +0200
|
||||
@@ -43,28 +43,29 @@ tsa_policy1 = 1.2.3.4.1
|
||||
tsa_policy2 = 1.2.3.4.5.6
|
||||
tsa_policy3 = 1.2.3.4.5.7
|
||||
|
||||
-# For FIPS
|
||||
-# Optionally include a file that is generated by the OpenSSL fipsinstall
|
||||
-# application. This file contains configuration data required by the OpenSSL
|
||||
-# fips provider. It contains a named section e.g. [fips_sect] which is
|
||||
-# referenced from the [provider_sect] below.
|
||||
-# Refer to the OpenSSL security policy for more information.
|
||||
-# .include fipsmodule.cnf
|
||||
-
|
||||
[openssl_init]
|
||||
providers = provider_sect
|
||||
# Load default TLS policy configuration
|
||||
ssl_conf = ssl_module
|
||||
|
||||
-# List of providers to load
|
||||
+# Uncomment the sections that start with ## below to enable the legacy provider.
|
||||
+# Loading the legacy provider enables support for the following algorithms:
|
||||
+# Hashing Algorithms / Message Digests: MD2, MD4, MDC2, WHIRLPOOL, RIPEMD160
|
||||
+# Symmetric Ciphers: Blowfish, CAST, DES, IDEA, RC2, RC4,RC5, SEED
|
||||
+# Key Derivation Function (KDF): PBKDF1
|
||||
+# In general it is not recommended to use the above mentioned algorithms for
|
||||
+# security critical operations, as they are cryptographically weak or vulnerable
|
||||
+# to side-channel attacks and as such have been deprecated.
|
||||
+
|
||||
[provider_sect]
|
||||
-default = default_sect
|
||||
-# The fips section name should match the section name inside the
|
||||
-# included fipsmodule.cnf.
|
||||
-# fips = fips_sect
|
||||
-
|
||||
-[default_sect]
|
||||
-# activate = 1
|
||||
+##default = default_sect
|
||||
+##legacy = legacy_sect
|
||||
+##
|
||||
+##[default_sect]
|
||||
+##activate = 1
|
||||
+##
|
||||
+##[legacy_sect]
|
||||
+##activate = 1
|
||||
|
||||
[ ssl_module ]
|
||||
|
||||
diff -up openssl-3.0.0-beta2/doc/man5/config.pod.legacy-prov openssl-3.0.0-beta2/doc/man5/config.pod
|
||||
--- openssl-3.0.0-beta2/doc/man5/config.pod.legacy-prov 2021-08-16 14:12:35.021606001 +0200
|
||||
+++ openssl-3.0.0-beta2/doc/man5/config.pod 2021-08-16 14:14:47.077396867 +0200
|
||||
@@ -269,6 +269,14 @@ significant.
|
||||
All parameters in the section as well as sub-sections are made
|
||||
available to the provider.
|
||||
|
||||
+=head3 Loading the legacy provider
|
||||
+
|
||||
+Uncomment the sections that start with ## in openssl.cnf
|
||||
+to enable the legacy provider.
|
||||
+Note: In general it is not recommended to use the above mentioned algorithms for
|
||||
+security critical operations, as they are cryptographically weak or vulnerable
|
||||
+to side-channel attacks and as such have been deprecated.
|
||||
+
|
||||
=head2 EVP Configuration
|
||||
|
||||
The name B<alg_section> in the initialization section names the section
|
||||
Loading…
Reference in new issue