FIPS: dnssec-keygen: fatal: RSA key size 1024 out of range
After f4eb3ba4 (#3672 (closed)), the inline
system test fails in FIPS CI jobs, which are not run in merge request-triggered pipelines only in daily scheduled pipelines:
- FIPS on OL8 - https://gitlab.isc.org/isc-projects/bind9/-/jobs/3537827
- FIPS on OL9 - https://gitlab.isc.org/isc-projects/bind9/-/jobs/3537828
The offending command is:
$ dnssec-keygen -q -a RSASHA256 -b 1024 -n zone nsec3-loop
dnssec-keygen: fatal: RSA key size 1024 out of range
And because of it, the ns7
server fails to start:
24-Jul-2023 11:41:59.674 /root/bind9/bin/tests/system/inline_tmp_q5nct_sn/ns7/named.conf:52: dnssec-policy: load policy 'nsec3'
24-Jul-2023 11:41:59.674 /root/bind9/bin/tests/system/inline_tmp_q5nct_sn/ns7/named.conf:56: dnssec-policy: key with algorithm RSASHA256 has invalid key length 1024