[freeipa PR#5640][opened] Allowed longer RSA key lengths and PSS signing algorithm in certificate profiles
by ysyvachenko
URL: https://github.com/freeipa/freeipa/pull/5640
Author: ysyvachenko
Title: #5640: Allowed longer RSA key lengths and PSS signing algorithm in certificate profiles
Action: opened
PR body:
"""
Allowed longer RSA key lengths and PSS signing algorithm in all profiles to be sync with Dogtag and OpenSSL.
- Allowed using RSA key length up to 16384, this is what OpenSSL recommends to generate. OpenSSL can generate longer keys but shows a warning that it is not recommended.
- Allowed using RSA-PSS signing algorithms. Starting from version 10.10.5 Dogtag supports an instruction 'pki_use_pss_rsa_signing_algorithm=True',
which can be enabled in FreeIPA via --pki-config-override. The instruction enforces using RSA-PSS from PKCS#1 v2.1 instead of PKCS#1 v1.5.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5640/head:pr5640
git checkout pr5640
2 years, 8 months
ldap principal left after uninstall
by Rob Crittenden
I don't know if this is something odd with my setup so before
investigating I thought I'd ask.
I was testing an upgrade change so I installed one server and then added
a replica with a CA. Doing this number of rounds of install/uninstall on
the replica and it would frequently fail trying to get a keytab for DS.
I noticed that after uninstall the ldap principal for the server
remained. How I have no idea.
Anyone else seen this?
Note: I tweaked my initial server so it's possible I messed something up
but this is an unexpected side effect if so.
rob
2 years, 8 months