The new SFCB broker fails to start with a SSL-related error: Failure setting ECDH curve name (secp22

最新推荐文章于 2025-06-20 11:10:30 发布

转载最新推荐文章于 2025-06-20 11:10:30 发布 · 380 阅读

收录于

本文介绍了解决sfcbd默认ECDH曲线secp224r1在OpenSSL上不可用的问题。通过设置sslEcDhCurveName为secp384r1，可在Fedora上使软件包安装后正常工作。

# openssl ecparam -list_curves
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field

The problem is that sfcbd's default secp224r1 ECDH curve is not currently enabled in openssl on Fedora (there's already request to enable it, see rhbz#1067697).

This can be workarounded by setting "sslEcDhCurveName: secp384r1" in "/etc/sfcb/sfcb.cfg".

I will change the default curve to "secp384r1" temporarily to make the package work right after installation.

https://bugzilla.redhat.com/show_bug.cgi?id=1097794

注意 OpenSSL的版本，旧一些的版本没有ecparam