From 562b65ca38cfe79bce1d33bec363fe72f903a8b6 Mon Sep 17 00:00:00 2001 From: Mikhail Kasimov Date: Fri, 11 May 2018 02:17:27 +0300 Subject: [PATCH 1/2] man: systemd-journal-upload: rsa 2048 rsa:2048 is currently in use as minimal recommended key length on cert/key generating. Specifying rsa:1024 is not recommended for security reasons. --- man/systemd-journal-upload.service.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/man/systemd-journal-upload.service.xml b/man/systemd-journal-upload.service.xml index 992f7e6119..7ca2ca4f18 100644 --- a/man/systemd-journal-upload.service.xml +++ b/man/systemd-journal-upload.service.xml @@ -263,10 +263,10 @@ echo 0001 >serial SERVER=server CLIENT=client -openssl req -newkey rsa:1024 -nodes -out $SERVER.csr -keyout $SERVER.key -subj "/CN=$SERVER/" +openssl req -newkey rsa:2048 -nodes -out $SERVER.csr -keyout $SERVER.key -subj "/CN=$SERVER/" openssl ca -batch -config ca.conf -notext -in $SERVER.csr -out $SERVER.pem -openssl req -newkey rsa:1024 -nodes -out $CLIENT.csr -keyout $CLIENT.key -subj "/CN=$CLIENT/" +openssl req -newkey rsa:2048 -nodes -out $CLIENT.csr -keyout $CLIENT.key -subj "/CN=$CLIENT/" openssl ca -batch -config ca.conf -notext -in $CLIENT.csr -out $CLIENT.pem From 32f511ec2b128a69b95d97391fb49f2071b9a9d8 Mon Sep 17 00:00:00 2001 From: Mikhail Kasimov Date: Fri, 11 May 2018 02:43:00 +0300 Subject: [PATCH 2/2] Update systemd-journal-upload.service.xml Security note on 2048 bits is added. --- man/systemd-journal-upload.service.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/man/systemd-journal-upload.service.xml b/man/systemd-journal-upload.service.xml index 7ca2ca4f18..74686d0119 100644 --- a/man/systemd-journal-upload.service.xml +++ b/man/systemd-journal-upload.service.xml @@ -228,7 +228,8 @@ legitimate, and vice versa, that the client is trusted. A suitable set of certificates can be generated with - openssl: + openssl. Note, 2048 bits of key length + is minimally recommended to use for security reasons: openssl req -newkey rsa:2048 -days 3650 -x509 -nodes \ -out ca.pem -keyout ca.key -subj '/CN=Certificate authority/'