OpenSSL 3.2

[chrisburr]

OpenSSL 3.2 was recently released with the notable change that the default SSL/TLS security level has been changed from 1 to 2:

https://github.com/openssl/openssl/blob/openssl-3.2.0/NEWS.md#openssl-32

This means 1024-bit certificates might no longer work. We already had this when we upgraded to Python 3.10 and had a workaround: #6299

The next DIRACOS2 release will likely break 1024-bit crypto for good. The error will show up something like M2Crypto.SSL.SSLError: ee key too small. If any one sees this you should get new certificates which are more secure.

#mightnotworkforgridppbutitsbeenoverayearsotimetomovetothemoresecurefuture

[marianne013]

Oy !!! When we upgraded to v8, we had a number of words (possibly including swearing) to convince DIRAC to stop generating 1024 proxies.

[marianne013]

#mightnotworkfordirac
#7324

[chaen]

#6286 should be enough no ? Unless of course you still have very old proxies in your DB :-)