mod_nss

#10 No way to disable step-down certificates
Closed: wontfix Opened by rcritten.

Closed: wontfix
Reopen Issue

Cloned from BZ https://bugzilla.redhat.com/show_bug.cgi?id=637525

If your certificate key size greater than 512 bits a 512 bit key-pair is generated on the fly for every ssl server. This takes considerable time and maybe the use of a 512 bit key might be unwanted.

  1. Load/Create 1024bit certificate into certificate database
  2. Put export NSS_DEBUG_PKCS11_MODULE="NSS Internal PKCS #11 Module" to get timing information (debug build nss)
  3. service start httpd

Starting httpd: 

Function                     # Calls         Time         Avg.     % Time
--8<--
C_GenerateKeyPair                  1         53ms   53000.00us      3.77%
--8<--

Expected no call to C_GenerateKeyPair and stepdown key disabled in NSS.

A patch is attached to the BZ.

The option is now deprecated upstream, closing as WONTFIX

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue priority set to: None (was: 3)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
defect
core
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.