Prior to Update: E: DH group offered: RFC5114/2048-bit DSA group with 224-bit prime order subgroup (2048 bits) D: DH group offered: RFC5114/2048-bit DSA group with 224-bit prime order subgroup (2048 bits) B: DH group offered: HAProxy (1024 bits) => D+E on wrong defaults!
With tuning to specific key (2048): tune.ssl.default-dh-param 2048 E: DH group offered: RFC5114/2048-bit DSA group with 224-bit prime order subgroup (2048 bits) D: DH group offered: RFC5114/2048-bit DSA group with 224-bit prime order subgroup (2048 bits) B: DH group offered: HAProxy (2048 bits) => E+D ignore the config! ## Post Update ## E: DH group offered: HAProxy (1024 bits) D: DH group offered: HAProxy (1024 bits) B: DH group offered: HAProxy (1024 bits) => E+D back on the expected default => B not broken by rebuild With tuning to specific key (2048): tune.ssl.default-dh-param 2048 E: DH group offered: HAProxy (2048 bits) D: DH group offered: HAProxy (2048 bits) B: DH group offered: HAProxy (2048 bits) => E+D: Config now works => B not broken by rebuild Also on Bionic now (for the initial TLSv1.3 request): OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 Testing protocols via sockets except NPN+ALPN SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered (deprecated) TLS 1.1 offered (deprecated) TLS 1.2 offered (OK) TLS 1.3 offered (OK): final ... Thanks to David for the extended test with a real configuration! Marking this verified ** Tags removed: verification-needed verification-needed-bionic verification-needed-disco verification-needed-eoan ** Tags added: verification-done verification-done-bionic verification-done-disco verification-done-eoan -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1841936 Title: Rebuild openssl 1.1.1 to pickup TLSv1.3 (bionic) and unbreak existing builds against 1.1.1 (dh key size) To manage notifications about this bug go to: https://bugs.launchpad.net/haproxy/+bug/1841936/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
