GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — test: use 2048 bit RSA keys by mmomtchev · Pull Request #44498 · nodejs/node

Conversation

@mmomtchev

@mmomtchev mmomtchev commented Sep 2, 2022

Copy link
Copy Markdown
Contributor

OpenSSL now requires at least 2048
Refs: #44497

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bricss reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. test Issues and PRs related to Node.js core tests and test infrastructure. labels Sep 2, 2022
lpinca
lpinca approved these changes Sep 3, 2022
View reviewed changes
@lpinca

lpinca commented Sep 3, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Are you planning to update certs and keys in a follow-up PR?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mmomtchev

mmomtchev commented Sep 3, 2022

Copy link
Copy Markdown
Contributor Author

@lpinca Just realized that these were comitted too, done

lpinca reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@lpinca lpinca added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 3, 2022
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 3, 2022
@nodejs-github-bot

nodejs-github-bot commented Sep 3, 2022

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/46399/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mmomtchev
mmomtchev marked this pull request as draft September 3, 2022 12:18
@mmomtchev
mmomtchev force-pushed the rsa-key-length branch 2 times, most recently from ccdd394 to 814ebc5 Compare September 3, 2022 16:43
@mmomtchev

mmomtchev commented Sep 4, 2022

Copy link
Copy Markdown
Contributor Author

@lpinca This turned to be much more laborious that I previously thought so I scaled it back to simply replacing all 1024 bit keys with 2048 bit keys, I am leaving the 2048->4096 transition to the next unlucky soul because there is a list of hard-coded test vectors produced with another crypto system meant for testing compatibility.

There is also the DH512 keys which have been blocked (?) because of the logjam attack, I will do them separately

lpinca reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mmomtchev
mmomtchev marked this pull request as ready for review September 4, 2022 00:09
@github-actions github-actions Bot mentioned this pull request Sep 4, 2022
CI Reliability 2022-09-04 nodejs/reliability#367
Open
24 tasks
@mmomtchev
mmomtchev force-pushed the rsa-key-length branch from bdd42cc to a27d6ae Compare September 4, 2022 16:07
@github-actions github-actions Bot mentioned this pull request Sep 5, 2022
CI Reliability 2022-09-05 nodejs/reliability#368
Open
17 tasks
@lpinca lpinca added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 5, 2022
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 5, 2022
@nodejs-github-bot

nodejs-github-bot commented Sep 5, 2022

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/46427/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mmomtchev

mmomtchev commented Sep 5, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

node-test-commit-linuxone-rhel8-s390x is an abort on an out of memory condition - is this a flaky test?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Sep 6, 2022
CI Reliability 2022-09-06 nodejs/reliability#369
Open
CI Reliability 2022-09-07 nodejs/reliability#370
Open
@mmomtchev mmomtchev changed the title test: use 4096 bit RSA keys test: use 2048 bit RSA keys Sep 7, 2022
This was referenced Sep 8, 2022
CI Reliability 2022-09-08 nodejs/reliability#371
Open
CI Reliability 2022-09-09 nodejs/reliability#372
Open
CI Reliability 2022-09-10 nodejs/reliability#373
Open
CI Reliability 2022-09-11 nodejs/reliability#374
Open
@lpinca lpinca added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 17, 2022
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 17, 2022
@nodejs-github-bot

nodejs-github-bot commented Sep 17, 2022

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/46641/

mmomtchev reacted with thumbs up emoji mmomtchev reacted with hooray emoji
All reactions
  • 👍 1 reaction
  • 🎉 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

codebytere added a commit to electron/electron that referenced this pull request Nov 6, 2023
@codebytere
chore: fixup Node.js BSSL tests
422032e
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 14, 2023
@codebytere
chore: fixup Node.js BSSL tests
703ddf9
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 15, 2023
@codebytere
chore: fixup Node.js BSSL tests
bc150a5
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 16, 2023
@codebytere
chore: fixup Node.js BSSL tests
59671c0
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 21, 2023
@codebytere
chore: fixup Node.js BSSL tests
9ce7e8c
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 22, 2023
@codebytere
chore: fixup Node.js BSSL tests
f3b52dc
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 28, 2023
@codebytere
chore: fixup Node.js BSSL tests
927e565
* nodejs/node#49492
* nodejs/node#44498
codebytere added a commit to electron/electron that referenced this pull request Nov 29, 2023
@codebytere
chore: fixup Node.js BSSL tests
40a8636
* nodejs/node#49492
* nodejs/node#44498
jkleinsc pushed a commit to electron/electron that referenced this pull request Nov 30, 2023
@codebytere @VerteDinde @MarshallOfSound
chore: upgrade to Node.js v20 (#40545)
9c94fd7
* chore: upgrade to Node.js v20

* src: allow embedders to override NODE_MODULE_VERSION

nodejs/node#49279

* src: fix missing trailing ,

nodejs/node#46909

* src,tools: initialize cppgc

nodejs/node#45704

* tools: allow passing absolute path of config.gypi in js2c

nodejs/node#49162

* tools: port js2c.py to C++

nodejs/node#46997

* doc,lib: disambiguate the old term, NativeModule

nodejs/node#45673

* chore: fixup Node.js BSSL tests

* nodejs/node#49492
* nodejs/node#44498

* deps: upgrade to libuv 1.45.0

nodejs/node#48078

* deps: update V8 to 10.7

nodejs/node#44741

* test: use gcUntil() in test-v8-serialize-leak

nodejs/node#49168

* module: make CJS load from ESM loader

nodejs/node#47999

* src: make BuiltinLoader threadsafe and non-global

nodejs/node#45942

* chore: address changes to CJS/ESM loading

* module: make CJS load from ESM loader (nodejs/node#47999)
* lib: improve esm resolve performance (nodejs/node#46652)

* bootstrap: optimize modules loaded in the built-in snapshot

nodejs/node#45849

* test: mark test-runner-output as flaky

nodejs/node#49854

* lib: lazy-load deps in modules/run_main.js

nodejs/node#45849

* url: use private properties for brand check

nodejs/node#46904

* test: refactor `test-node-output-errors`

nodejs/node#48992

* assert: deprecate callTracker

nodejs/node#47740

* src: cast v8::Object::GetInternalField() return value to v8::Value

nodejs/node#48943

* test: adapt test-v8-stats for V8 update

nodejs/node#45230

* tls: ensure TLS Sockets are closed if the underlying wrap closes

nodejs/node#49327

* test: deflake test-tls-socket-close

nodejs/node#49575

* net: fix crash due to simultaneous close/shutdown on JS Stream Sockets

nodejs/node#49400

* net: use asserts in JS Socket Stream to catch races in future

nodejs/node#49400

* lib: fix BroadcastChannel initialization location

nodejs/node#46864

* src: create BaseObject with node::Realm

nodejs/node#44348

* src: implement DataQueue and non-memory resident Blob

nodejs/node#45258

* sea: add support for V8 bytecode-only caching

nodejs/node#48191

* chore: fixup patch indices

* gyp: put filenames in variables

nodejs/node#46965

* build: modify js2c.py into GN executable

* fix: (WIP) handle string replacement of fs -> original-fs

* [v20.x] backport vm-related memory fixes

nodejs/node#49874

* src: make BuiltinLoader threadsafe and non-global

nodejs/node#45942

* src: avoid copying string in fs_permission

nodejs/node#47746

* look upon my works ye mighty

and dispair

* chore: patch cleanup

* [api] Remove AllCan Read/Write

https://chromium-review.googlesource.com/c/v8/v8/+/5006387

* fix: missing include for NODE_EXTERN

* chore: fixup patch indices

* fix: fail properly when js2c fails in Node.js

* build: fix js2c root_gen_dir

* fix: lib/fs.js -> lib/original-fs.js

* build: fix original-fs file xforms

* fixup! module: make CJS load from ESM loader

* build: get rid of CppHeap for now

* build: add patch to prevent extra fs lookup on esm load

* build: greatly simplify js2c modifications

Moves our original-fs modifications back into a super simple python script action, wires up the output of that action into our call to js2c

* chore: update to handle moved internal/modules/helpers file

* test: update @types/node test

* feat: enable preventing cppgc heap creation

* feat: optionally prevent calling V8::EnableWebAssemblyTrapHandler

* fix: no cppgc initialization in the renderer

* gyp: put filenames in variables

nodejs/node#46965

* test: disable single executable tests

* fix: nan tests failing on node headers missing file

* tls,http2: send fatal alert on ALPN mismatch

nodejs/node#44031

* test: disable snapshot tests

* nodejs/node#47887
* nodejs/node#49684
* nodejs/node#44193

* build: use deps/v8 for v8/tools

Node.js hard depends on these in their builtins

* test: fix edge snapshot stack traces

nodejs/node#49659

* build: remove js2c //base dep

* build: use electron_js2c_toolchain to build node_js2c

* fix: don't create SafeSet outside packageResolve

Fixes failure in parallel/test-require-delete-array-iterator:

=== release test-require-delete-array-iterator ===
Path: parallel/test-require-delete-array-iterator
node:internal/per_context/primordials:426
    constructor(i) { super(i); } // eslint-disable-line no-useless-constructor
                     ^

TypeError: object is not iterable (cannot read property Symbol(Symbol.iterator))
    at new Set (<anonymous>)
    at new SafeSet (node:internal/per_context/primordials:426:22)

* fix: failing crashReporter tests on Linux

These were failing because our change from node::InitializeNodeWithArgs to
node::InitializeOncePerProcess meant that we now inadvertently called
PlatformInit, which reset signal handling. This meant that our intentional
crash function ElectronBindings::Crash no longer worked and the renderer process
no longer crashed when process.crash() was called. We don't want to use Node.js'
default signal handling in the renderer process, so we disable it by passing
kNoDefaultSignalHandling to node::InitializeOncePerProcess.

* build: only create cppgc heap on non-32 bit platforms

* chore: clean up util:CompileAndCall

* src: fix compatility with upcoming V8 12.1 APIs

nodejs/node#50709

* fix: use thread_local BuiltinLoader

* chore: fixup v8 patch indices

---------

Co-authored-by: Keeley Hammond <[email protected]>
Co-authored-by: Samuel Attard <[email protected]>
MrHuangJser pushed a commit to MrHuangJser/electron that referenced this pull request Dec 11, 2023
@codebytere @VerteDinde
@MarshallOfSound MrHuangJser
chore: upgrade to Node.js v20 (electron#40545)
34651d1
* chore: upgrade to Node.js v20

* src: allow embedders to override NODE_MODULE_VERSION

nodejs/node#49279

* src: fix missing trailing ,

nodejs/node#46909

* src,tools: initialize cppgc

nodejs/node#45704

* tools: allow passing absolute path of config.gypi in js2c

nodejs/node#49162

* tools: port js2c.py to C++

nodejs/node#46997

* doc,lib: disambiguate the old term, NativeModule

nodejs/node#45673

* chore: fixup Node.js BSSL tests

* nodejs/node#49492
* nodejs/node#44498

* deps: upgrade to libuv 1.45.0

nodejs/node#48078

* deps: update V8 to 10.7

nodejs/node#44741

* test: use gcUntil() in test-v8-serialize-leak

nodejs/node#49168

* module: make CJS load from ESM loader

nodejs/node#47999

* src: make BuiltinLoader threadsafe and non-global

nodejs/node#45942

* chore: address changes to CJS/ESM loading

* module: make CJS load from ESM loader (nodejs/node#47999)
* lib: improve esm resolve performance (nodejs/node#46652)

* bootstrap: optimize modules loaded in the built-in snapshot

nodejs/node#45849

* test: mark test-runner-output as flaky

nodejs/node#49854

* lib: lazy-load deps in modules/run_main.js

nodejs/node#45849

* url: use private properties for brand check

nodejs/node#46904

* test: refactor `test-node-output-errors`

nodejs/node#48992

* assert: deprecate callTracker

nodejs/node#47740

* src: cast v8::Object::GetInternalField() return value to v8::Value

nodejs/node#48943

* test: adapt test-v8-stats for V8 update

nodejs/node#45230

* tls: ensure TLS Sockets are closed if the underlying wrap closes

nodejs/node#49327

* test: deflake test-tls-socket-close

nodejs/node#49575

* net: fix crash due to simultaneous close/shutdown on JS Stream Sockets

nodejs/node#49400

* net: use asserts in JS Socket Stream to catch races in future

nodejs/node#49400

* lib: fix BroadcastChannel initialization location

nodejs/node#46864

* src: create BaseObject with node::Realm

nodejs/node#44348

* src: implement DataQueue and non-memory resident Blob

nodejs/node#45258

* sea: add support for V8 bytecode-only caching

nodejs/node#48191

* chore: fixup patch indices

* gyp: put filenames in variables

nodejs/node#46965

* build: modify js2c.py into GN executable

* fix: (WIP) handle string replacement of fs -> original-fs

* [v20.x] backport vm-related memory fixes

nodejs/node#49874

* src: make BuiltinLoader threadsafe and non-global

nodejs/node#45942

* src: avoid copying string in fs_permission

nodejs/node#47746

* look upon my works ye mighty

and dispair

* chore: patch cleanup

* [api] Remove AllCan Read/Write

https://chromium-review.googlesource.com/c/v8/v8/+/5006387

* fix: missing include for NODE_EXTERN

* chore: fixup patch indices

* fix: fail properly when js2c fails in Node.js

* build: fix js2c root_gen_dir

* fix: lib/fs.js -> lib/original-fs.js

* build: fix original-fs file xforms

* fixup! module: make CJS load from ESM loader

* build: get rid of CppHeap for now

* build: add patch to prevent extra fs lookup on esm load

* build: greatly simplify js2c modifications

Moves our original-fs modifications back into a super simple python script action, wires up the output of that action into our call to js2c

* chore: update to handle moved internal/modules/helpers file

* test: update @types/node test

* feat: enable preventing cppgc heap creation

* feat: optionally prevent calling V8::EnableWebAssemblyTrapHandler

* fix: no cppgc initialization in the renderer

* gyp: put filenames in variables

nodejs/node#46965

* test: disable single executable tests

* fix: nan tests failing on node headers missing file

* tls,http2: send fatal alert on ALPN mismatch

nodejs/node#44031

* test: disable snapshot tests

* nodejs/node#47887
* nodejs/node#49684
* nodejs/node#44193

* build: use deps/v8 for v8/tools

Node.js hard depends on these in their builtins

* test: fix edge snapshot stack traces

nodejs/node#49659

* build: remove js2c //base dep

* build: use electron_js2c_toolchain to build node_js2c

* fix: don't create SafeSet outside packageResolve

Fixes failure in parallel/test-require-delete-array-iterator:

=== release test-require-delete-array-iterator ===
Path: parallel/test-require-delete-array-iterator
node:internal/per_context/primordials:426
    constructor(i) { super(i); } // eslint-disable-line no-useless-constructor
                     ^

TypeError: object is not iterable (cannot read property Symbol(Symbol.iterator))
    at new Set (<anonymous>)
    at new SafeSet (node:internal/per_context/primordials:426:22)

* fix: failing crashReporter tests on Linux

These were failing because our change from node::InitializeNodeWithArgs to
node::InitializeOncePerProcess meant that we now inadvertently called
PlatformInit, which reset signal handling. This meant that our intentional
crash function ElectronBindings::Crash no longer worked and the renderer process
no longer crashed when process.crash() was called. We don't want to use Node.js'
default signal handling in the renderer process, so we disable it by passing
kNoDefaultSignalHandling to node::InitializeOncePerProcess.

* build: only create cppgc heap on non-32 bit platforms

* chore: clean up util:CompileAndCall

* src: fix compatility with upcoming V8 12.1 APIs

nodejs/node#50709

* fix: use thread_local BuiltinLoader

* chore: fixup v8 patch indices

---------

Co-authored-by: Keeley Hammond <[email protected]>
Co-authored-by: Samuel Attard <[email protected]>
mhdawson added a commit to mhdawson/io.js that referenced this pull request Aug 27, 2024
@mhdawson
test: increase key size for ca2-cert.pem
27d19d6
Refs: nodejs#44498
Refs: nodejs#53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
nodejs#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
@mhdawson mhdawson mentioned this pull request Aug 27, 2024
test: increase key size for ca2-cert.pem #54599
Merged
nodejs-github-bot pushed a commit that referenced this pull request Aug 29, 2024
@mhdawson
test: increase key size for ca2-cert.pem
01f751b
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Aug 30, 2024
@mhdawson @RafaelGSS
test: increase key size for ca2-cert.pem
f1a16af
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Sep 1, 2024
@mhdawson @RafaelGSS
test: increase key size for ca2-cert.pem
edbecf5
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
targos pushed a commit that referenced this pull request Sep 22, 2024
@mhdawson @targos
test: increase key size for ca2-cert.pem
59bada0
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
targos pushed a commit that referenced this pull request Sep 26, 2024
@mhdawson @targos
test: increase key size for ca2-cert.pem
0b5ad14
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
richardlau pushed a commit to aduh95/node that referenced this pull request Sep 27, 2024
@mhdawson @richardlau
test: increase key size for ca2-cert.pem
d5b73e5
Refs: nodejs#44498
Refs: nodejs#53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
nodejs#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: nodejs#54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
maitrungduc1410 pushed a commit to maitrungduc1410/webrtc that referenced this pull request Oct 1, 2024
@fippo WebRTC LUCI CQ
ssl: increase default RSA key size to 2048 bits
d79a185
since 1024 is already deprecated by OpenSSL and causes "too small key"
issues on systems enforcing a minimum size. Similar issue here:
  nodejs/node#44498

The minimum key size is not yet changed from 1024, this will require more effort for deprecation.

BUG=webrtc:364338811

Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128
Reviewed-by: David Benjamin <[email protected]>
Reviewed-by: Harald Alvestrand <[email protected]>
Commit-Queue: Philipp Hancke <[email protected]>
Cr-Commit-Position: refs/heads/main@{#43110}
targos pushed a commit that referenced this pull request Oct 2, 2024
@mhdawson @targos
test: increase key size for ca2-cert.pem
a50bbca
Refs: #44498
Refs: #53382

Key sizes were increased to 2048 in PR 44498 including
the configuration file for the generation of ca2-cert.pem.
However, it seems like updating ca2-cert.pem and related files
themselves were missed as they were not updated in the PR and
the ca2-cert.pem reported as being associated with a 1024 bit key.
I believe that was the cause of some of the failures mentioned in
#53382 as OpenSSL 3.2
increased the default security level from 1 to 2 and that
would mean that certificates associated with keys of 1024 bits
would no longer be accepted.

This PR updates the key size for ca2-cert.pem. It was not
necessary to change the config, only run the generation for
the ca2-cert.pem and related files.

Signed-off-by: Michael Dawson <[email protected]>
PR-URL: #54599
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Nov 26, 2024
@mfromanmoz
Bug 1928110 - Vendor libwebrtc from d79a1859e0
1eaf74c
Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79
    ssl: increase default RSA key size to 2048 bits

    since 1024 is already deprecated by OpenSSL and causes "too small key"
    issues on systems enforcing a minimum size. Similar issue here:
      nodejs/node#44498

    The minimum key size is not yet changed from 1024, this will require more effort for deprecation.

    BUG=webrtc:364338811

    Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed
    Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128
    Reviewed-by: David Benjamin <[email protected]>
    Reviewed-by: Harald Alvestrand <[email protected]>
    Commit-Queue: Philipp Hancke <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#43110}
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this pull request Nov 26, 2024
@marco-c
Bug 1928110 - Vendor libwebrtc from d79a1859e0
b3d9780
Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79
    ssl: increase default RSA key size to 2048 bits

    since 1024 is already deprecated by OpenSSL and causes "too small key"
    issues on systems enforcing a minimum size. Similar issue here:
      nodejs/node#44498

    The minimum key size is not yet changed from 1024, this will require more effort for deprecation.

    BUG=webrtc:364338811

    Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed
    Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128
    Reviewed-by: David Benjamin <davidbenwebrtc.org>
    Reviewed-by: Harald Alvestrand <htawebrtc.org>
    Commit-Queue: Philipp Hancke <phanckemeta.com>
    Cr-Commit-Position: refs/heads/main{#43110}

UltraBlame original commit: a674447f7a1f2d87718780cf2311b324c10f5384
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this pull request Nov 27, 2024
@marco-c
Bug 1928110 - Vendor libwebrtc from d79a1859e0
d0725a3
Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79
    ssl: increase default RSA key size to 2048 bits

    since 1024 is already deprecated by OpenSSL and causes "too small key"
    issues on systems enforcing a minimum size. Similar issue here:
      nodejs/node#44498

    The minimum key size is not yet changed from 1024, this will require more effort for deprecation.

    BUG=webrtc:364338811

    Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed
    Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128
    Reviewed-by: David Benjamin <davidbenwebrtc.org>
    Reviewed-by: Harald Alvestrand <htawebrtc.org>
    Commit-Queue: Philipp Hancke <phanckemeta.com>
    Cr-Commit-Position: refs/heads/main{#43110}

UltraBlame original commit: a674447f7a1f2d87718780cf2311b324c10f5384
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this pull request Nov 27, 2024
@marco-c
Bug 1928110 - Vendor libwebrtc from d79a1859e0
4e96f8c
Upstream commit: https://webrtc.googlesource.com/src/+/d79a1859e058b6a030177b24ed8e4bb14525af79
    ssl: increase default RSA key size to 2048 bits

    since 1024 is already deprecated by OpenSSL and causes "too small key"
    issues on systems enforcing a minimum size. Similar issue here:
      nodejs/node#44498

    The minimum key size is not yet changed from 1024, this will require more effort for deprecation.

    BUG=webrtc:364338811

    Change-Id: Id4b24a2c289ec5e3f112288d32b8ac697ba1cfed
    Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/361128
    Reviewed-by: David Benjamin <davidbenwebrtc.org>
    Reviewed-by: Harald Alvestrand <htawebrtc.org>
    Commit-Queue: Philipp Hancke <phanckemeta.com>
    Cr-Commit-Position: refs/heads/main{#43110}

UltraBlame original commit: a674447f7a1f2d87718780cf2311b324c10f5384
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca approved these changes
+1 more reviewer
@mhdawson mhdawson mhdawson approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. commit-queue-squash PRs the Commit Queue should land as one squashed commit. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. review wanted PRs that need review. test Issues and PRs related to Node.js core tests and test infrastructure.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

7 participants

@mmomtchev @lpinca @nodejs-github-bot @juanarbol @mhdawson @panva @richardlau
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.