Skip to content

Add RHEL 8 crypto policy limitation for certificate key sizes #1752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 8, 2025
Merged

Add RHEL 8 crypto policy limitation for certificate key sizes #1752

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e60ba45
Add RHEL 8 crypto policy limitation for certificate key sizes
mich-elle-luna Jun 24, 2025
a2c77f8
Update content/embeds/supported-platforms-embed.md
mich-elle-luna Jun 25, 2025
a882114
Update updating-certificates.md
mich-elle-luna Jul 8, 2025
e12df67
Update supported-platforms-embed.md
mich-elle-luna Jul 8, 2025
e2b1bfd
Update updating-certificates.md
mich-elle-luna Jul 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion content/embeds/supported-platforms-embed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,13 @@ The RHEL-compatible distributions CentOS, CentOS Stream, Alma Linux, Rocky Linux

### TLS 1.0 and TLS 1.1

Redis Enterprise Software version 6.2.8 removed support for TLS 1.0 and TLS 1.1 on Red Hat Enterprise Linux 8 (RHEL 8) because that operating system [does not enable support](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening) for these versions by default.
Redis Enterprise Software version 6.2.8 removed support for TLS 1.0 and TLS 1.1 on Red Hat Enterprise Linux 8 (RHEL 8) because that operating system [does not enable support](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening) for these versions by default.

### RHEL 8 crypto policy and certificate key size

In RHEL 8, if the crypto policy is set to `FUTURE`, the system will not accept certificates with private key sizes smaller than 3072 bits. This affects users who use custom certificates with smaller keys (such as 2048-bit keys).

If you want to continue using certificates with smaller key sizes, you need to change the crypto policy from `FUTURE` to `DEFAULT`. For more information about crypto policies, see the [Red Hat documentation on system-wide cryptographic policies](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening).

### Ubuntu 20 rejects SHA1 certificates

Expand Down