Dan Kenigsberg has submitted this change and it was merged.
Change subject: bootstrap: remove dh key generation
......................................................................
bootstrap: remove dh key generation
Before VDSM used libvirt, it configured qemu with spice TLS with
DH key. Using DH key for TLS/SSL is encouraged, as it detach between
the encryption and authentication layers.
qemu supports x509-dh-key-file parameter, libvirt does not use this
parameter.
qemu supports x509-dir parameter, within it expects to find pre-defined
structure of certificate and key material. libvirt does use this
parameter. However, qemu only looks for ca, crl, cert, key, so even if
we have DH key, it won't be used.
Removing DH key generation.
Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47
Signed-off-by: Alon Bar-Lev <alonbl(a)redhat.com>
---
M vds_bootstrap/vds_bootstrap.py
M vdsm_reg/deployUtil.py.in
M vdsm_reg/vdsm-gen-cert
3 files changed, 3 insertions(+), 11 deletions(-)
Approvals:
Alon Bar-Lev: Verified
Dan Kenigsberg: Looks good to me, approved
--
To view, visit
http://gerrit.ovirt.org/7073
To unsubscribe, visit
http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I820c8599516cd4c4e3bf7ad73ee2c1c6dee22c47
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Alon Bar-Lev <alonbl(a)redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl(a)redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com>
Gerrit-Reviewer: Doron Fediuck <dfediuck(a)redhat.com>
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com>
Gerrit-Reviewer: Yaniv Kaul <ykaul(a)redhat.com>
Gerrit-Reviewer: oVirt Jenkins CI Server