This usage flag was deprecated by RFC8813, such that it is
forbidden to be present for certs using ECDSA/ECDH algorithms,
and in TLS 1.3 is conceptually obsolete.
As such many valid certs will no longer have this key usage
flag set, and QEMU should not be rejecting them, as this
prevents use of otherwise valid & desirable algorithms.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/tlscredsx509.c | 10 +-------
docs/system/tls.rst | 13 +++-------
tests/unit/crypto-tls-x509-helpers.h | 6 ++---
tests/unit/test-crypto-tlscredsx509.c | 36 +++++++++++++--------------
tests/unit/test-crypto-tlssession.c | 14 +++++------
tests/unit/test-io-channel-tls.c | 4 +--
6 files changed, 34 insertions(+), 49 deletions(-)
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index e21d85fe16..f26429736c 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -144,7 +144,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
if (status < 0) {
if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT;
+ GNUTLS_KEY_DIGITAL_SIGNATURE;
} else {
error_setg(errp,
"Unable to query certificate %s key usage: %s",
@@ -171,14 +171,6 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
return -1;
}
}
- if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
- if (critical) {
- error_setg(errp,
- "Certificate %s usage does not permit key "
- "encipherment", certFile);
- return -1;
- }
- }
}
return 0;
diff --git a/docs/system/tls.rst b/docs/system/tls.rst
index e284c82801..a4f6781d62 100644
--- a/docs/system/tls.rst
+++ b/docs/system/tls.rst
@@ -118,7 +118,6 @@ information for each server, and use it to issue server certificates.
ip_address = 2620:0:cafe::87
ip_address = 2001:24::92
tls_www_server
- encryption_key
signing_key
EOF
# certtool --generate-privkey > server-hostNNN-key.pem
@@ -134,9 +133,8 @@ the subject alt name extension data. The ``tls_www_server`` keyword is
the key purpose extension to indicate this certificate is intended for
usage in a web server. Although QEMU network services are not in fact
HTTP servers (except for VNC websockets), setting this key purpose is
-still recommended. The ``encryption_key`` and ``signing_key`` keyword is
-the key usage extension to indicate this certificate is intended for
-usage in the data session.
+still recommended. The ``signing_key`` keyword is the key usage extension
+to indicate this certificate is intended for usage in the data session.
The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files
should now be securely copied to the server for which they were
@@ -171,7 +169,6 @@ certificates.
organization = Name of your organization
cn = hostNNN.foo.example.com
tls_www_client
- encryption_key
signing_key
EOF
# certtool --generate-privkey > client-hostNNN-key.pem
@@ -187,9 +184,8 @@ the ``dns_name`` and ``ip_address`` fields are not included. The
``tls_www_client`` keyword is the key purpose extension to indicate this
certificate is intended for usage in a web client. Although QEMU network
clients are not in fact HTTP clients, setting this key purpose is still
-recommended. The ``encryption_key`` and ``signing_key`` keyword is the
-key usage extension to indicate this certificate is intended for usage
-in the data session.
+recommended. The ``signing_key`` keyword is the key usage extension to
+indicate this certificate is intended for usage in the data session.
The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files
should now be securely copied to the client for which they were
@@ -222,7 +218,6 @@ client and server instructions in one.
ip_address = 2001:24::92
tls_www_server
tls_www_client
- encryption_key
signing_key
EOF
# certtool --generate-privkey > both-hostNNN-key.pem
diff --git a/tests/unit/crypto-tls-x509-helpers.h b/tests/unit/crypto-tls-x509-helpers.h
index 2a0f7c04fd..7e9a508ad6 100644
--- a/tests/unit/crypto-tls-x509-helpers.h
+++ b/tests/unit/crypto-tls-x509-helpers.h
@@ -148,8 +148,7 @@ void test_tls_cleanup(const char *keyfile);
.basicConstraintsIsCA = false, \
.keyUsageEnable = true, \
.keyUsageCritical = true, \
- .keyUsageValue = \
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
+ .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
.keyPurposeEnable = true, \
.keyPurposeCritical = true, \
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \
@@ -168,8 +167,7 @@ void test_tls_cleanup(const char *keyfile);
.basicConstraintsIsCA = false, \
.keyUsageEnable = true, \
.keyUsageCritical = true, \
- .keyUsageValue = \
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
+ .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
.keyPurposeEnable = true, \
.keyPurposeCritical = true, \
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index 96ad4e741b..a5f21728d4 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -169,14 +169,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
@@ -199,7 +199,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
@@ -214,7 +214,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
@@ -229,7 +229,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
@@ -253,7 +253,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
/* no-basic */
@@ -267,7 +267,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
/* Key usage:dig-sig:critical */
@@ -281,7 +281,7 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
@@ -306,7 +306,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
+ GNUTLS_KEY_DIGITAL_SIGNATURE |
GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
@@ -409,7 +409,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
+ GNUTLS_KEY_DIGITAL_SIGNATURE |
GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
@@ -511,21 +511,21 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(servercertexp1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, -1);
TLS_CERT_REQ(clientcertexp1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, -1);
@@ -549,21 +549,21 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(servercertnew1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
1, 2);
TLS_CERT_REQ(clientcertnew1req, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
1, 2);
@@ -614,14 +614,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
"UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-tlssession.c
index 61311cbe6e..d0baf3b304 100644
--- a/tests/unit/test-crypto-tlssession.c
+++ b/tests/unit/test-crypto-tlssession.c
@@ -472,14 +472,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
@@ -487,7 +487,7 @@ int main(int argc, char **argv)
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
@@ -506,7 +506,7 @@ int main(int argc, char **argv)
"192.168.122.1", "fec0::dead:beaf",
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
/* This intentionally doesn't replicate */
@@ -515,7 +515,7 @@ int main(int argc, char **argv)
"192.168.122.1", "fec0::dead:beaf",
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
@@ -619,14 +619,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
"UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
diff --git a/tests/unit/test-io-channel-tls.c b/tests/unit/test-io-channel-tls.c
index 6f282ad45d..4e4034af67 100644
--- a/tests/unit/test-io-channel-tls.c
+++ b/tests/unit/test-io-channel-tls.c
@@ -302,14 +302,14 @@ int main(int argc, char **argv)
"UK", "qemu.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "qemu", NULL, NULL, NULL, NULL,
true, true, false,
true, true,
- GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_KEY_DIGITAL_SIGNATURE,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
--
2.50.1
This patch is relevant to pick for all stable branches.
Not critical, but a "nice to have" fix if it cherry picks
cleanly.
On Fri, Oct 24, 2025 at 02:19:36PM +0100, Daniel P. Berrangé wrote:
> This usage flag was deprecated by RFC8813, such that it is
> forbidden to be present for certs using ECDSA/ECDH algorithms,
> and in TLS 1.3 is conceptually obsolete.
>
> As such many valid certs will no longer have this key usage
> flag set, and QEMU should not be rejecting them, as this
> prevents use of otherwise valid & desirable algorithms.
>
> Reviewed-by: Eric Blake <eblake@redhat.com>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
> crypto/tlscredsx509.c | 10 +-------
> docs/system/tls.rst | 13 +++-------
> tests/unit/crypto-tls-x509-helpers.h | 6 ++---
> tests/unit/test-crypto-tlscredsx509.c | 36 +++++++++++++--------------
> tests/unit/test-crypto-tlssession.c | 14 +++++------
> tests/unit/test-io-channel-tls.c | 4 +--
> 6 files changed, 34 insertions(+), 49 deletions(-)
>
> diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
> index e21d85fe16..f26429736c 100644
> --- a/crypto/tlscredsx509.c
> +++ b/crypto/tlscredsx509.c
> @@ -144,7 +144,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
> if (status < 0) {
> if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
> usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT;
> + GNUTLS_KEY_DIGITAL_SIGNATURE;
> } else {
> error_setg(errp,
> "Unable to query certificate %s key usage: %s",
> @@ -171,14 +171,6 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
> return -1;
> }
> }
> - if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
> - if (critical) {
> - error_setg(errp,
> - "Certificate %s usage does not permit key "
> - "encipherment", certFile);
> - return -1;
> - }
> - }
> }
>
> return 0;
> diff --git a/docs/system/tls.rst b/docs/system/tls.rst
> index e284c82801..a4f6781d62 100644
> --- a/docs/system/tls.rst
> +++ b/docs/system/tls.rst
> @@ -118,7 +118,6 @@ information for each server, and use it to issue server certificates.
> ip_address = 2620:0:cafe::87
> ip_address = 2001:24::92
> tls_www_server
> - encryption_key
> signing_key
> EOF
> # certtool --generate-privkey > server-hostNNN-key.pem
> @@ -134,9 +133,8 @@ the subject alt name extension data. The ``tls_www_server`` keyword is
> the key purpose extension to indicate this certificate is intended for
> usage in a web server. Although QEMU network services are not in fact
> HTTP servers (except for VNC websockets), setting this key purpose is
> -still recommended. The ``encryption_key`` and ``signing_key`` keyword is
> -the key usage extension to indicate this certificate is intended for
> -usage in the data session.
> +still recommended. The ``signing_key`` keyword is the key usage extension
> +to indicate this certificate is intended for usage in the data session.
>
> The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files
> should now be securely copied to the server for which they were
> @@ -171,7 +169,6 @@ certificates.
> organization = Name of your organization
> cn = hostNNN.foo.example.com
> tls_www_client
> - encryption_key
> signing_key
> EOF
> # certtool --generate-privkey > client-hostNNN-key.pem
> @@ -187,9 +184,8 @@ the ``dns_name`` and ``ip_address`` fields are not included. The
> ``tls_www_client`` keyword is the key purpose extension to indicate this
> certificate is intended for usage in a web client. Although QEMU network
> clients are not in fact HTTP clients, setting this key purpose is still
> -recommended. The ``encryption_key`` and ``signing_key`` keyword is the
> -key usage extension to indicate this certificate is intended for usage
> -in the data session.
> +recommended. The ``signing_key`` keyword is the key usage extension to
> +indicate this certificate is intended for usage in the data session.
>
> The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files
> should now be securely copied to the client for which they were
> @@ -222,7 +218,6 @@ client and server instructions in one.
> ip_address = 2001:24::92
> tls_www_server
> tls_www_client
> - encryption_key
> signing_key
> EOF
> # certtool --generate-privkey > both-hostNNN-key.pem
> diff --git a/tests/unit/crypto-tls-x509-helpers.h b/tests/unit/crypto-tls-x509-helpers.h
> index 2a0f7c04fd..7e9a508ad6 100644
> --- a/tests/unit/crypto-tls-x509-helpers.h
> +++ b/tests/unit/crypto-tls-x509-helpers.h
> @@ -148,8 +148,7 @@ void test_tls_cleanup(const char *keyfile);
> .basicConstraintsIsCA = false, \
> .keyUsageEnable = true, \
> .keyUsageCritical = true, \
> - .keyUsageValue = \
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
> + .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
> .keyPurposeEnable = true, \
> .keyPurposeCritical = true, \
> .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \
> @@ -168,8 +167,7 @@ void test_tls_cleanup(const char *keyfile);
> .basicConstraintsIsCA = false, \
> .keyUsageEnable = true, \
> .keyUsageCritical = true, \
> - .keyUsageValue = \
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
> + .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE, \
> .keyPurposeEnable = true, \
> .keyPurposeCritical = true, \
> .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \
> diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
> index 96ad4e741b..a5f21728d4 100644
> --- a/tests/unit/test-crypto-tlscredsx509.c
> +++ b/tests/unit/test-crypto-tlscredsx509.c
> @@ -169,14 +169,14 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(clientcertreq, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> @@ -199,7 +199,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
>
> @@ -214,7 +214,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
>
> @@ -229,7 +229,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
>
> @@ -253,7 +253,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> /* no-basic */
> @@ -267,7 +267,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> /* Key usage:dig-sig:critical */
> @@ -281,7 +281,7 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
>
> @@ -306,7 +306,7 @@ int main(int argc, char **argv)
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
> + GNUTLS_KEY_DIGITAL_SIGNATURE |
> GNUTLS_KEY_KEY_CERT_SIGN,
> false, false, NULL, NULL,
> 0, 0);
> @@ -409,7 +409,7 @@ int main(int argc, char **argv)
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
> + GNUTLS_KEY_DIGITAL_SIGNATURE |
> GNUTLS_KEY_KEY_CERT_SIGN,
> false, false, NULL, NULL,
> 0, 0);
> @@ -511,21 +511,21 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(servercertexp1req, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, -1);
> TLS_CERT_REQ(clientcertexp1req, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, -1);
>
> @@ -549,21 +549,21 @@ int main(int argc, char **argv)
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(servercertnew1req, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 1, 2);
> TLS_CERT_REQ(clientcertnew1req, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 1, 2);
>
> @@ -614,14 +614,14 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
> "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-tlssession.c
> index 61311cbe6e..d0baf3b304 100644
> --- a/tests/unit/test-crypto-tlssession.c
> +++ b/tests/unit/test-crypto-tlssession.c
> @@ -472,14 +472,14 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(clientcertreq, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> @@ -487,7 +487,7 @@ int main(int argc, char **argv)
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> @@ -506,7 +506,7 @@ int main(int argc, char **argv)
> "192.168.122.1", "fec0::dead:beaf",
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> /* This intentionally doesn't replicate */
> @@ -515,7 +515,7 @@ int main(int argc, char **argv)
> "192.168.122.1", "fec0::dead:beaf",
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
>
> @@ -619,14 +619,14 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
> "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> diff --git a/tests/unit/test-io-channel-tls.c b/tests/unit/test-io-channel-tls.c
> index 6f282ad45d..4e4034af67 100644
> --- a/tests/unit/test-io-channel-tls.c
> +++ b/tests/unit/test-io-channel-tls.c
> @@ -302,14 +302,14 @@ int main(int argc, char **argv)
> "UK", "qemu.org", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
> 0, 0);
> TLS_CERT_REQ(clientcertreq, cacertreq,
> "UK", "qemu", NULL, NULL, NULL, NULL,
> true, true, false,
> true, true,
> - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
> + GNUTLS_KEY_DIGITAL_SIGNATURE,
> true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
> 0, 0);
>
> --
> 2.50.1
>
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
© 2016 - 2025 Red Hat, Inc.