mod_nss

#18 If your certificate key size greater than 512 bits a stepdown key will be generated, this can't be swithed off from mod_nss
Closed: duplicate Opened by mharmsen.

Closed: duplicate
Reopen Issue

If your certificate key size greater than 512 bits a 512 bit key-pair is generated on the fly for every ssl server. This takes considerable time and maybe the use of a 512 bit key might be unwanted.

How reproducible:

Create Certificate with key size bigger than 512.

Steps to Reproduce:

1. Load/Create 1024bit certificate into certificate database
2. Put export NSS_DEBUG_PKCS11_MODULE="NSS Internal PKCS #11 Module"
   to get timing information (debug build nss)
3. service start httpd

Actual results:

Starting httpd: Function      # Calls         Time         Avg.     % Time
--8<--
C_GenerateKeyPair                   1         53ms   53000.00us      3.77%
--8<--

Expected results:

No call to C_GenerateKeyPair and stepdown key disabled in NSS

Associated Bugs:

Duplicate of issue 10

Metadata Update from @rcritten:
- Issue close_status updated to: duplicate
- Issue priority set to: None (was: 3)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
defect
core
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.