releng

#9450 EPEL 8 Modular repo certificate
Closed: Can't Fix by kevin. Opened by bcotton.

Closed: Can't Fix
Reopen Issue

  • Describe the issue
    As reported in RHBZ 1832292, it appears the EPEL 8 repo metalink has a certificate that DNF doesn't like when run on CentOS 8 in "FUTURE" crypto policy. This seems like the best starting point to Do Something.

  • When do you need this? (YYYY/MM/DD)
    Let's say 2020/05/26 as an arbitrary date.

  • When is this no longer needed or useful? (YYYY/MM/DD)
    When EPEL 8 goes EOL

  • If we cannot complete your request, what is the impact?
    WONTFIX the bug and we say "FUTURE" crypto policy is not supported for this.

From the grooming meeting today

we will look into this, but it's something in the cert chain, not us directly, so we aren't going to be fixing it fast/soon

Metadata Update from @mohanboddu:
- Issue tagged with: groomed

So, we can't fix this.

The problem is that the FUTURE setting requires rsa certs be > 3072 bits.

The *.fedoraproject.org cert is 4096, so thats fine.

However, the intermediate and root certs from digicert (our cert provider), are still 2048, and fail this test.

We can ask digicert to issue larger bit CA certs, but thats something they would have to choose to do. I can ask via our rep if there are any plans to do this.

Metadata Update from @kevin:
- Issue close_status updated to: Can't Fix
- Issue status updated to: Closed (was: Open)

Sorry to comment on such an old issue, but is it possible to at least document what in the FUTURE policy needs to be altered to allow EPEL?

So we only know about the 3072 bit item. There could be multiple others which might impact it working. As such we can't really document a 'fix'.

Metadata
None

groomed

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.