MCLOUD-6469: dh key too small when trying to use magento-cloud-docker-tls

[oshmyheliuk]

Description

Changed security level in /etc/ssl/openssl.cnf to avoid dh key too small error

Fixed Issues (if relevant)

https://jira.corp.magento.com/browse/MCLOUD-6469

Manual testing scenarios

1. Install magento 2.4.0 in docker
2. Connect to fpm container:
   docker exec -it magento-cloud_fpm_1 bash
3. Run command
   curl -k https://tls.magento2.docker/ will return an error dh key too small
4. Run docker-compose down -v
5. Build php fpm image from branch
   docker build -t magento-cloud-docker-php-fpm-6469 images/php/7.4-fpm
6. Change docker-compose.yaml file

  fpm:
    hostname: fpm.magento2.docker
    image: 'magento-cloud-docker-php-fpm-6469'

7. Run docker-compose up -d
docker-compose run build cloud-build
docker-compose run deploy cloud-deploy
docker-compose run deploy cloud-post-deploy
8. Connect to fpm container:
   docker exec -it magento-cloud_fpm_1 bash
9. Run command
   curl -k https://tls.magento2.docker/ command run without error

Release notes

Changed the security level in the OpenSSL configuration file (/etc/ssl/openssl.cnf) to fix a dh key too small error that occurs on TLS connection requests in the Cloud Docker environment.

Associated documentation updates

Not required.

Contribution checklist

• Pull request has a meaningful description of its purpose
• Pull request introduces user-facing changes and includes meaningful release notes and documentation
• All commits are accompanied by meaningful commit messages

[mkozell]

Would the solution be to change how the SSL key and certificate are generated in tls.magento2.docker compared to changing the SECLEVEL in the PHP images? Doesn't changing SECLEVEL from 2 to 1 decrease security?

[oshmyheliuk]

@mkozell I tried to generate RSA:2048, RSA:4096, and RSA:8192 but still have the same error.
According to the description of SECLEVEL=2 it should be enough but it doesn't work.

Level 2
Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.

Do you know how to generate certificate and keys which satisfies SECLEVEL=2

[mveeramneni]

QA Approved

[mkozell]

@mkozell I tried to generate RSA:2048, RSA:4096, and RSA:8192 but still have the same error.
According to the description of SECLEVEL=2 it should be enough but it doesn't work.

Level 2
Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.

Do you know how to generate certificate and keys which satisfies SECLEVEL=2

It looks like a newer version of Pound may be needed for supporting larger DH keys.

[oshmyheliuk]

@mkozell Yes, Pound 2.7+ supports longer keys, we already have pr for that #277