In FIPS mode the default cipher is AES.

diff --git a/src/certtool.c b/src/certtool.c
index e7b79ef25ef65f852ca9739ce03e7d8550ea9eb6..5f92e7d2156e8d1c1199df87512f629623dad5d2 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -139,7 +139,11 @@ generate_private_key_int(common_info_st * cinfo)
 static int cipher_to_flags(const char *cipher)
 {
        if (cipher == NULL) {
+#ifdef ENABLE_FIPS140
+               return GNUTLS_PKCS_USE_PBES2_AES_128;
+#else /* compatibility mode - most implementations don't support AES */
                return GNUTLS_PKCS_USE_PKCS12_ARCFOUR;
+#endif
        } else if (strcasecmp(cipher, "3des") == 0) {
                return GNUTLS_PKCS_USE_PBES2_3DES;
        } else if (strcasecmp(cipher, "3des-pkcs12") == 0) {