Jira (PDB-4728) create dh key is too small

[Blue Umbrella (Jira)]

Title: Message Title

Blue Umbrella created an issue   PuppetDB / PDB-4728 create dh key is too small Issue Type: Bug Affects Versions: PDB 6.10.1 Assignee: Unassigned Created: 2020/05/10 6:44 PM Priority: Normal Reporter: Blue Umbrella ran "puppetdb ssl-setup" and then tried to verify the SSL connectivity after doing "systemctl start puppetdb" (centos 8.1). (there is no "CentOS 8" in either agent-os or master-os.) openssl's s_client program reports that the DH key is too small and fails to verify the certificate, e.g: openssl s_client -connect puppetdb:8081 CONNECTED(00000003) Can't use SSL_get_servername depth=0 CN = host.name verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = host.name verify error:num=21:unable to verify the first certificate verify return:1 140169246222144:error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small:ssl/statem/statem_clnt.c:2150: — Certificate chain 0 s:CN = host.name i:CN = Puppet CA: host.name — Server certificate ----BEGIN CERTIFICATE---- ... ----END CERTIFICATE---- subject=CN = host.name issuer=CN = Puppet CA: host.name — No client certificate CA names sent — SSL handshake has read 2607 bytes and written 306 bytes Verification error: unable to verify the first certificate — New, (NONE), Cipher is (NONE) Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: 5EB8A662CB4DC70C91FF81A0B2EFD7F1960DF94CFA4FCD953751EEF586F5DD86 Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1589159522 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) Extended master secret: yes — Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.358154.1589161467000.58506.1589161500043%40Atlassian.JIRA.