[TLS] Update test certs to future proof settings

[tiran]

BPO	34542
Nosy	@larryhastings, @tiran, @alex, @dstufft, @miss-islington
PRs	bpo-34542: Update test certs and keys #8997 [3.7] bpo-34542: Update test certs and keys (GH-8997) #9007 [3.6] bpo-34542: Update test certs and keys (GH-8997) #9396 [2.7] bpo-34542: Update test certs and keys (GH-8997) #9397 [3.5] bpo-41183: Update test certs and keys #21258

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2020-07-02.07:10:32.601>
created_at = <Date 2018-08-29.14:17:16.189>
labels = ['expert-SSL', '3.8', 'type-bug', '3.7']
title = '[TLS] Update test certs to future proof settings'
updated_at = <Date 2020-07-02.07:10:32.596>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2020-07-02.07:10:32.596>
actor = 'larry'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2020-07-02.07:10:32.601>
closer = 'larry'
components = ['SSL']
creation = <Date 2018-08-29.14:17:16.189>
creator = 'christian.heimes'
dependencies = []
files = []
hgrepos = []
issue_num = 34542
keywords = ['patch']
message_count = 7.0
messages = ['324324', '324368', '324690', '325850', '325851', '372811', '372813']
nosy_count = 6.0
nosy_names = ['janssen', 'larry', 'christian.heimes', 'alex', 'dstufft', 'miss-islington']
pr_nums = ['8997', '9007', '9396', '9397', '21258']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue34542'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

[tiran]

In bug bpo-34399, I updated all RSA keys to 2048. However that not sufficient for future proof settings. Fedora's FUTURE crypto policy requires 3072bit RSA keys. Further more, I forgot to update the signature algorithm, too.

• RSA >= 3072bits
• finite field DH >= 3072bits
• signature algorithm with SHA2-256 or SHA2-384 PKCSv1 Support "bpo-" in Misc/NEWS #1.5 (I don't think RSASSA-PSS works with OpenSSL 1.0.2 or TLS < 1.0)

[tiran]

New changeset e6dac00 by Christian Heimes in branch 'master':
bpo-34542: Update test certs and keys (GH-8997)
e6dac00

[tiran]

New changeset 2d3f2dc by Christian Heimes (Miss Islington (bot)) in branch '3.7':
bpo-34542: Update test certs and keys (GH-8997) (GH-9007)
2d3f2dc

[miss-islington]

New changeset 1148510 by Miss Islington (bot) (Christian Heimes) in branch '3.6':
[3.6] bpo-34542: Update test certs and keys (GH-8997) (GH-9396)
1148510

[miss-islington]

New changeset 49d6595 by Miss Islington (bot) (Christian Heimes) in branch '2.7':
[2.7] bpo-34542: Update test certs and keys (GH-8997) (GH-9397)
49d6595

[larryhastings]

New changeset d565be8 by Christian Heimes in branch '3.5':
bpo-41183: Update test certs and keys (bpo-21258)
d565be8

[larryhastings]

I also needed a backport of this to 3.5. See bpo-41183.

Also, it looks like this issue should have been closed long ago, so I'll go ahead and do that.