ssl_params error on RHEL7 FIPS enabled

[Martin Olsen]

There have been multiple submitted fixes to this, I submitted a fix to Redhat myself. And they are not willing to add it to their EL7 at this point.

From: dovecot <dovecot-bounces at dovecot.org> on behalf of Brad Partin <bpartin2009 at gmail.com>
Date: Thursday, August 19, 2021 at 12:39 PM
To: "dovecot at dovecot.org" <dovecot at dovecot.org>
Subject: ssl_params error on RHEL7 FIPS enabled

[External Email]

All,

The machine I’m running dovecot on is:
RHEL7.9 3.10.0-1160.31.1.el7.x86_64

I can run Systemctl restart dovecot then status or
/usr/libexec/dovecot/ssl-params and I get the following error.

Info: Generating SSL parameters
Fatal: ssl_iostream_generate_params(4096) failed: DH_generate_parameters(bits=512, gen=2) failed: error:0506A06E:lib(5):func(106):reason(110), error 0506A003:lib(5):func(106):reason(3)
Error: child process failed with status 22784

I can generate a diffie-hellman pem with
openssl dhparam -out /etc/dovecot/dh.pem 4096
But dovecot 2.2.36 does not have the option of telling it where the dh.pem file is located in the config like version 2.3 does.
Is my error related to FIPS and is there a way around it?

My dovecot version is:
Dovecot version 2.2.36 release 8.el7

Thanks in advance to anyone willing to help out, I know it’s voluntary 🙏

Thanks,
bpartin2009

Sent from my iPhone
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20210819/f48b0247/attachment.html>