On 17 December 2013 18:11, Porter, Andrew <[email protected]> wrote: > We've into a problem with a native x86/Linux app of ours - linked > statically with vanilla openssl-fips-2.0.2 and openssl-1.0.1e we've > built - trying to connect to our Java app when it is running under > the latest OpenJDK 1.7.0_45 on RedHat 6.5 or OpenSUSE v13.1: > the native app logs > > SSL_connect: tlsv1 alert internal error > > and the Java app throws the exception: > > PKCS11Exception: CKR_DOMAIN_PARAMS_INVALID > > A little searching turned up a very close match to our scenario > in this RedHat bug report: > > https://bugzilla.redhat.com/show_bug.cgi?id=1022017 > > The conclusion (scroll down to comments 37/38) is that this is > a bug with openssl claiming to support an algorithm it doesn't, > and the RedHat version of the openssl 1.0.1e source has > been patched to fix this. > > Question: are they correct that this is an openssl bug? If so, > will this be fixed in a 1.0.1f or 1.02 release?
As I understand it Red Hat OpenSSL packages have restricted EC capabilities due to concerns about patents (although other distros do not share this concern): https://bugzilla.redhat.com/show_bug.cgi?id=319901 The bug that you refer to above concerns an issue with the Red Hat OpenSSL package incorrectly advertising support for an EC curve that has been deliberately removed by the Red Hat package maintainers, i.e. it is not a bug in OpenSSL itself, but in the Red Hat OpenSSL package. Matt ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
