Hi all,
Currently I'm setting up a FreeIPA instance on EL8 with the
crypto-policy set to FUTURE.
When running the ipa-server-install program, it errors out when setting
up the PKI infrastructure.
Below is the command I ran:
```
ipa-server-install --pki-config-override /root/freeipa_pki_override.cfg
--setup-adtrust -p Banana123! -a Banana123! -r
EXAMPLE.COM -U
```
As this command already shows, I already have some PKI override settings
to ensure all created keys are 4096 bits long:
```
[CA]
pki_ca_signing_key_size=4096
[DEFAULT]
pki_admin_key_size=4096
pki_audit_signing_key_size=4096
pki_sslserver_key_size=4096
pki_subsystem_key_size=4096
```
And even despite these settings, the command errors out giving me the
message as below:
```
..truncated..
[22/28]: enabling CA instance
[23/28]: migrating certificate profiles to LDAP
[24/28]: importing IPA certificate profiles
[error] NetworkError: cannot connect to
'https://ipa.lbhr.htm.lan:8443/ca/rest/account/login': [SSL: EE_KEY_TOO_SMALL] ee
key too small (_ssl.c:3542)
cannot connect to 'https://ipa.lbhr.htm.lan:8443/ca/rest/account/login': [SSL:
EE_KEY_TOO_SMALL] ee key too small (_ssl.c:3542)
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more
information
```
So _some_ certificate _somewhere_ is not strong enough, but I can't find
which one it is and how to ensure it's strengthened sufficiently.
When I check the log file it shows basically the same message (except
with a lot of Python stacktraces with 'NetworkError')
When I revert the crypto-policy back to DEFAULT the command as shown
above will succeed.
Anyone have a clue? :)
Cheers!
--
Kind regards,
Jeff