Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-90854

Enable sslkeylogfile support [RHEL-9]

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • openssl-3.5.0-2.el9
    • No
    • Low
    • 1
    • rhel-security-crypto
    • ssg_security
    • 19
    • 20
    • 0.1
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto25Q2
    • Hide

      AC1) enable-sslkeylog is present as a build option when we are building OpenSSL. [one-off manual verification]

      AC2) When SSLKEYLOGFILE environment variable is used, a file with the TLS connection secrets is created. [automated testing, /CoreOS/openssl/Regression/RHEL-90853-Enable-sslkeylogfile-support]

      Show
      AC1) enable-sslkeylog is present as a build option when we are building OpenSSL. [one-off manual verification] AC2) When SSLKEYLOGFILE environment variable is used, a file with the TLS connection secrets is created. [automated testing, /CoreOS/openssl/Regression/RHEL-90853-Enable-sslkeylogfile-support]
    • Pass
    • Not Needed
    • Automated
    • Feature
    • Hide
      .OpenSSL supports `sslkeylogfile`

      OpenSSL supports the `sslkeylogfile` format for TLS. As a result, you can log all secrets produced by SSL connections by setting the `SSLKEYLOGFILE` environment variable.

      [IMPORTANT]
      Enabling the `SSLKEYLOGFILE` variable poses an explicit security risk. Recording the exchanged keys during an SSL session allows anyone with read access to the file to decrypt application traffic sent over that session. Use this feature only in test and debug environments.
      Show
      .OpenSSL supports `sslkeylogfile` OpenSSL supports the `sslkeylogfile` format for TLS. As a result, you can log all secrets produced by SSL connections by setting the `SSLKEYLOGFILE` environment variable. [IMPORTANT] Enabling the `SSLKEYLOGFILE` variable poses an explicit security risk. Recording the exchanged keys during an SSL session allows anyone with read access to the file to decrypt application traffic sent over that session. Use this feature only in test and debug environments.
    • Done
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      With the rebase to OpenSSL 3.5, we can enable support for the SSLKEYLOGFILE environment variable to log TLS connection secrets through the build configuration option enable-sslkeylog.

      We want this build option by default.

              dbelyavs@redhat.com Dmitry Belyavskiy
              dbelyavs@redhat.com Dmitry Belyavskiy
              Dmitry Belyavskiy Dmitry Belyavskiy
              Conor Tull Conor Tull
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: