389-ds-base

#51060 Unable to set sslMinVersion to TLS1.0
Closed: wontfix by mreynolds. Opened by mreynolds.

Closed: wontfix
Reopen Issue

Issue Description

If you explicitly set the sslMinVersion to TLS1.0 the server would incorrectly and silently change it to TLS1.2.

https://pagure.io/389-ds-base/pull-request/51061

Metadata Update from @mreynolds:
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to review

Commit 3548738f fixes this issue

Commit 3548738 fixes this issue

6cc08673b..a514aba49 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

bc871b6c2..01b7ef727 389-ds-base-1.4.2 -> 389-ds-base-1.4.2

f4b777f53..8409e4833 389-ds-base-1.4.1 -> 389-ds-base-1.4.1

Metadata Update from @mreynolds:
- Issue close_status updated to: None (was: Fixed)

Metadata Update from @mreynolds:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1828881

Looks like this commit still does not fix the problem. I've taken the source rpms for the versions this patch was already applied to (1.4.2.13 https://koji.fedoraproject.org/koji/taskinfo?taskID=44236196 and 1.4.3.8 https://koji.fedoraproject.org/koji/taskinfo?taskID=44235118).

I've built these rpms on CentOS 8.1 (there is a little problem with 389-ds-base.spec of 1.4.2.13 that tries to move the nonexistent cockpit/389-console/rhds-banner.html) and installed them, they exhibit the same behavior.

Typical commands to test :

dsconf slapd-centos8 security set --tls-protocol-min="TLS1.1"
dsconf slapd-centos8 security set --tls-protocol-max="TLS1.1"
dsctl slapd-centos8 restart
dsconf centos8 security get | grep sslver
sslversionmin: TLS1.2
sslversionmax: TLS1.2

So i am still unable to set any other combination then TLS1.2/TLS1.2 (dse.ldif is correct but in slapd_ssl_init2 NSS adjusts the values or even rejects them "error -8190 (security library: received bad data.")
The extracts form the logs for different sslversionmin/sslversionmax cases :

...
[14/May/2020:16:10:00.645308395 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[14/May/2020:16:10:00.654257530 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.0
[14/May/2020:16:10:00.657316327 +0200] - ERR - Security Initialization - SSL failure: Security Initialization - slapd_ssl_init2 - Failed to set SSL range: min: TLS1.0, max: TLS1.0 - error -8190 (security library: received bad data.)
[14/May/2020:16:10:00.658297836 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2
[14/May/2020:16:10:00.659160980 +0200] - INFO - main - 389-Directory/1.4.2.13 B2020.134.175 starting up
...

...
[14/May/2020:16:10:40.248493697 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[14/May/2020:16:10:40.254650200 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.1
[14/May/2020:16:10:40.255359700 +0200] - ERR - Security Initialization - SSL failure: Security Initialization - slapd_ssl_init2 - Failed to set SSL range: min: TLS1.0, max: TLS1.1 - error -8190 (security library: received bad data.)
[14/May/2020:16:10:40.257202771 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2
[14/May/2020:16:10:40.257994772 +0200] - INFO - main - 389-Directory/1.4.2.13 B2020.134.175 starting up
...

...
[14/May/2020:16:11:54.874845977 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[14/May/2020:16:11:54.880924716 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.1, max: TLS1.1
[14/May/2020:16:11:54.881653542 +0200] - ERR - Security Initialization - SSL failure: Security Initialization - slapd_ssl_init2 - Failed to set SSL range: min: TLS1.1, max: TLS1.1 - error -8190 (security library: received bad data.)
[14/May/2020:16:11:54.882237450 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2
[14/May/2020:16:11:54.884244148 +0200] - INFO - main - 389-Directory/1.4.2.13 B2020.134.175 starting up
...

...
[14/May/2020:16:13:51.971073533 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[14/May/2020:16:13:51.976844836 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.0, max: TLS1.2
[14/May/2020:16:13:51.977602899 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2
[14/May/2020:16:13:51.979010046 +0200] - INFO - main - 389-Directory/1.4.2.13 B2020.134.175 starting up
...

...
[14/May/2020:16:15:11.598650255 +0200] - INFO - Security Initialization - SSL info: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled
[14/May/2020:16:15:11.604639481 +0200] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.1, max: TLS1.2
[14/May/2020:16:15:11.605616787 +0200] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2
[14/May/2020:16:15:11.607984182 +0200] - INFO - main - 389-Directory/1.4.2.13 B2020.134.175 starting up
...

Hnmm works fine for me on Fedora 31.

[root@localhost cli]# dsconf slapd-localhost security set --tls-protocol-min="TLS1.1"
[root@localhost cli]# dsconf slapd-localhost security set --tls-protocol-max="TLS1.1"
[root@localhost cli]# dsctl localhost restart
Instance "localhost" has been restarted

[root@localhost cli]# dsconf slapd-localhost security get
...
sslversionmin: TLS1.1
sslversionmax: TLS1.1

I then tried min of TLS 1.0 and max of 1.2:

[root@localhost cli]# dsconf slapd-localhost security set --tls-protocol-max="TLS1.2"
[root@localhost cli]# dsconf slapd-localhost security set --tls-protocol-min="TLS1.0"
[root@localhost cli]# dsctl localhost restart
Instance "localhost" has been restarted

[root@localhost cli]# dsconf slapd-localhost security get
...
sslversionmin: TLS1.0
sslversionmax: TLS1.2

I think it might be an issue with the system wide crypto policy on Centos8 - it might be rejecting the lower TLS versions.

I recall on RHEL 8, the default minimum version is TLS 1.2. I will need to test a RHEL 8 system to confirm...

Metadata Update from @mreynolds:
- Issue status updated to: Open (was: Closed)

I think it might be an issue with the system wide crypto policy on Centos8 - it might be rejecting the lower TLS versions.

I recall on RHEL 8, the default minimum version is TLS 1.2. I will need to test a RHEL 8 system to confirm...

RIght, here are the DEFAULT and LEGACY policies for RHEL8
https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/blob/rhel8/policies/DEFAULT.pol

min_tls_version = TLS1.2

https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/blob/rhel8/policies/LEGACY.pol

min_tls_version = TLS1.0

Compare these to Fedora:
https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/blob/master/policies/DEFAULT.pol

min_tls_version = TLS1.0

NSS adjusted SSL version range: min: TLS1.2, max: TLS1.2

This should help:

# update-crypto-policies --set LEGACY

Thank you! Indeed, setting 

update-crypto-policies --set LEGACY

does help to fix the problem in RHEL8/CentOS8. Maybe it should be added somewhere to the documentation of RHDS11 that sslVersionMin and sslVersionMax values are influenced by the system-wide settings of crypto policies...

Metadata Update from @mreynolds:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/4113

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: fixed)
Metadata
None
None
None
Low
review
None
Related Pull Requests
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.