]> git.ipfire.org Git - thirdparty/libvirt.git/commit
tls: Don't require 'keyEncipherment' to be enabled altoghther
authorPeter Krempa <pkrempa@redhat.com>
Mon, 30 Jun 2025 17:19:42 +0000 (19:19 +0200)
committerPeter Krempa <pkrempa@redhat.com>
Tue, 8 Jul 2025 12:52:16 +0000 (14:52 +0200)
commit8cecd3249e5fa5478a7c53567971b4d969274ea3
treebb765255cd60fda58f598d78a2444b0974f60021
parent1c2295fbafab12cb3f943aab8bd015e167cad533
tls: Don't require 'keyEncipherment' to be enabled altoghther

Key encipherment is required only for RSA key exchange algorithm. With
TLS 1.3 this is not even used as RSA is used only for authentication.

Since we can't really check when it's required ahead of time drop the
check completely. GnuTLS will moan if it will not be able to use RSA
key exchange.

In commit 11867b0224a2 I tried to relax the check for some eliptic
curve algorithm that explicitly forbid it. Based on the above the proper
solution is to completely remove it.

Resolves: https://issues.redhat.com/browse/RHEL-100711
Fixes: 11867b0224a2b8dc34755ff0ace446b6842df1c1
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
src/rpc/virnettlscert.c