URL:
https://github.com/freeipa/freeipa/pull/5640
Author: ysyvachenko
Title: #5640: Allowed longer RSA key lengths and PSS signing algorithm in certificate
profiles
Action: opened
PR body:
"""
Allowed longer RSA key lengths and PSS signing algorithm in all profiles to be sync with
Dogtag and OpenSSL.
- Allowed using RSA key length up to 16384, this is what OpenSSL recommends to generate.
OpenSSL can generate longer keys but shows a warning that it is not recommended.
- Allowed using RSA-PSS signing algorithms. Starting from version 10.10.5 Dogtag supports
an instruction 'pki_use_pss_rsa_signing_algorithm=True',
which can be enabled in FreeIPA via --pki-config-override. The instruction enforces
using RSA-PSS from PKCS#1 v2.1 instead of PKCS#1 v1.5.
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5640/head:pr5640
git checkout pr5640