On Thu, 13 Nov 2014 01:37:13 +0200
Anssi Johansson <epel(a)miuku.net> wrote:
I believe the problem is not really SSLv3, but that the Fedora
Project uses 4096 bit keys, which the old nss can't handle. I was
unable to locate any other web server that used 4096 bit keys when I
was diagnosing the issue back then, so I was unable to confirm my
theory.
Well, we changed certs in April after heartbleed. I would expect if
that broke things we would have seen it before now.
CentOS 6.4 without any updates does not work, but works with
C6.4's
nss and nspr update. nss-3.14.3-4.el6_4 is the oldest version that
works. CentOS 6.5 and later will of course work as well.
To fix the problem: yum update --disablerepo=epel\*
If your nss is too old to handle Fedora's certificates, it means you
haven't run "yum update" for more than a year and you are missing a
large bunch of important CentOS updates.
Yeah.
kevin