Dan Kenigsberg has submitted this change and it was merged.
Change subject: bootstrap: remove dh key generation ......................................................................
bootstrap: remove dh key generation
Before VDSM used libvirt, it configured qemu with spice TLS with DH key. Using DH key for TLS/SSL is encouraged, as it detach between the encryption and authentication layers.
qemu supports x509-dh-key-file parameter, libvirt does not use this parameter.
qemu supports x509-dir parameter, within it expects to find pre-defined structure of certificate and key material. libvirt does use this parameter. However, qemu only looks for ca, crl, cert, key, so even if we have DH key, it won't be used.
Removing DH key generation.
Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Signed-off-by: Alon Bar-Lev alonbl@redhat.com --- M vds_bootstrap/vds_bootstrap.py M vdsm_reg/deployUtil.py.in M vdsm_reg/vdsm-gen-cert 3 files changed, 3 insertions(+), 11 deletions(-)
Approvals: Alon Bar-Lev: Verified Dan Kenigsberg: Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/7073 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Alon Bar-Lev alonbl@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Doron Fediuck dfediuck@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Yaniv Kaul ykaul@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server