ssl_cert=SELFSIGNED and global_default_dh_param
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
charm-haproxy |
New
|
Undecided
|
Unassigned |
Bug Description
When using the ssl_cert=SELFSIGNED and trying to set the global_
Turns out that the parameter tries to match the cert key file, as mentioned here:
https:/
And our key wasn't recreated in quite a long time and was still at 1024 bits (although the default was already at 2048).
This resulted in the dh key sizes to be at 1024 bit and it was rather difficult to find the reason for it.
To create a new key, I had to delete it on the unit and run the config-changed hook manually. It then defaulted to 2048 (which was enough for me).
It would be helpful to either put out some warnings when using different key sizes like that, or at least put a note into the help text of the global_
description: | updated |