Re: Updated libpq5 packages cause connection errors on postgresql 9.2

On Fri, Dec 19, 2014 at 11:52 AM, Christoph Berg <cb(at)df7cb(dot)de> wrote:
>
> Re: Chris Butler 2014-12-19 <
> 1155204201(dot)65430(dot)1418975376728(dot)JavaMail(dot)zimbra(at)zedcore(dot)com>
> > One of our servers is currently running on postgres 9.2 using the
> 9.2.9-1.pgdg70+1 packages from pgdg.
> >
> > After an apt update this morning which brought in the libpq5 package
> version 9.4.0-1.pgdg70+1, connections to the database started failing with
> SSL errors logged on the server:
> >
> > [unknown] [unknown] LOG: could not accept SSL connection: digest too
> big for rsa key
> >
> > Rolling back the server and client to libpq5 version 9.3.5-2.pgdg70+1
> fixed it.
> >
> > This is running on an otherwise up-to-date Debian Wheezy. The SSL
> certificate is locally issued using an internal CA which has been added to
> the local trust store. SSL-related config options are left set to the
> defaults.
>
> Hi Chris,
>
> thanks for the report.
>
> Googling for "digest too big for rsa key" seems to indicate that this
> problem occurs when you are using (client?) certificates with short
> RSA keys. 512 bits is most often cited in the problem reports,
> something like 768 is around the minimum size that works, and of
> course, anything smaller than 1024 or really 1536 (or 2048) bits is
> too small for today's crypto standards.
>
> So the question here is if this is also the problem you saw - are you
> using client or server certificates with short keys?
>
> What this explanation doesn't explain is why the problem occurs with
> 9.4's libpq5 while it works with 9.3's. The libssl version used for
> building these packages should really be the same, 9.3.5-2.pgdg70+1
> was built just two days ago as well.
>
> I'm CCing -hackers, maybe someone there has an idea.
>

Some googling shows that this could be because it's negotiating TLS 1.2
which the key is just too small for. And we did change that in 9.4 - commit
326e1d73c476a0b5061ef00134bdf57aed70d5e7 disabled SSL in favor of always
using TLS for security reasons.

--
Magnus Hagander
Me: http://www.hagander.net/
Work: http://www.redpill-linpro.com/