You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2011/01/18 14:46:39 UTC

DO NOT REPLY [Bug 50608] New: SSLFIPS Directive

https://issues.apache.org/bugzilla/show_bug.cgi?id=50608

           Summary: SSLFIPS Directive
           Product: Apache httpd-2
           Version: 2.2.17
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: jyerge@tenable.com


Created an attachment (id=26506)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=26506)
Files to reproduce issue

We're running Apache 2.2.17 compiled against OpenSSL 0.9.8q with the FIPS 1.2
module, we're using PHP 5.3.5. Our platform is Redhat ES5.

When we introduce the SSLFIPS directive in our httpd.conf and log in to our
application (which requires a license) the license files to decrypt via PHP.
However, without the SSLFIPS directive, everything works fine. We've been
digging through this and trying to figure out what's going on, it appears to be
something FIPS enabled. I've attached a tarball containing instructions, PHP
scripts, and keys to reproduce this issue.

If you need further information, feel free to ask.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 50608] SSLFIPS Directive

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50608

--- Comment #2 from jyerge@tenable.com 2011-01-20 08:18:09 EST ---
We are the application vendor and we've attempted to create the pub/priv keys
in FIPS mode and are still encountering this issue.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 50608] SSLFIPS Directive

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50608

--- Comment #3 from William A. Rowe Jr. <wr...@apache.org> 2011-01-20 19:14:51 EST ---
Please review http://openssl.org/docs/fips/ - it is incumbent upon you to
thoroughly understand openssl's FIPS operating mode if you are attempting
to set this in conjunction with your software - what is and what is not
FIPS validated.  This remains your issue, with the openssl library, and
has nothing whatsoever to do with Apache software.

SSLFIPS On does exactly what it says, it changes the operating mode of
the openssl library, and the impact of that is for you to understand and
compensate for.  Or else don't enable it.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 50608] SSLFIPS Directive

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50608

jyerge@tenable.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         OS/Version|Windows XP                  |Linux

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 50608] SSLFIPS Directive

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=50608

William A. Rowe Jr. <wr...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from William A. Rowe Jr. <wr...@apache.org> 2011-01-18 09:02:39 EST ---
Take this up with your application vendor, their license check uses some
FIPS-prohibited ciphers or hash.  This is not a support forum, it's a tracker
for flaws in the software.  Peer-to-peer user support should always be
directed to the users list.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org