What were you trying to do that didn't work?

When using the FUTURE policy, @SECLEVEL=3 enforces using 3072+ bits RSA keys, but it appears the OpenSSL configuration file /etc/pki/tls/openssl.cnf doesn't enforce this, causing openssl req or openssl genrsa commands to generate 2048 bits RSA keys by default:

[ req ]
default_bits            = 2048

This is an important issue for OpenSSL clients generating keys, such as cockpit-ws or tog-pegasus.

What is the impact of this issue to you?

Self-signed certificates being generated are not usable

Please provide the package NVR for which the bug is seen:

crypto-policies-20240828-2.git626aa59.el9_5.noarch

How reproducible is this bug?:

Always

Steps to reproduce

1. Switch to FUTURE policy
2. Generate a RSA key

Expected results

3072 bits RSA key

Actual results

2048 bits RSA key