freeipa

#7995 Removing TLSv1.0, TLSv1.1 from nss.conf
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1711172

Problem:
-> Insights reports the following "Decreased security in httpd when using
deprecated TLS protocol version (PCI DSS)"
# grep NSSProtocol /etc/httpd/conf.d/nss.conf
NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2
Question?
Why we still have the weak protocols still enabled and then have Insights
complain about this.
Action Item:
- Use latest NSS version available.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1711172

Note: this issue only applies to FreeIPA versions using mod_nss (mod_ssl is used from 4.7.0+).

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3351

ipa-4-6:

  • 3d6a2a215ed61255f3275efb67d5e04c474a664b mod_nss: stop using NSSProtocols TLS 1.0 and 1.1
  • a5b6f72d4f2a8287c7f095874d71ef536822d20b Use only TLS 1.2 by default

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 14be2715334e16a2d3f07a6b64bcd6d068ce89c1 ipatests: add test to check that only TLS 1.2 is enabled in Apache

ipa-4-7:

  • f9566100a512656b98b72baf708becc7870750c4 ipatests: add test to check that only TLS 1.2 is enabled in Apache

ipa-4-8:

  • 686b85b14b14134c32c737c6df2de610153f4323 ipatests: add test to check that only TLS 1.2 is enabled in Apache

ipa-4-6:

  • c5ff32870d22f7c42edec63c686a730d7bcf21cc Log stderr in run_command
  • aa0ecc93ff0faad6663add73d5e013775ce4a68f ipatests: modify run_command to allow specify successful return codes
  • 4487fc43d036481a315574bfe719b10a57c54a64 ipatests: add test to check that only TLS 1.2 is enabled in Apache
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/3351
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.