CentOS Stream 9 – Common Problem 123 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Apps fail to load legacy keys/ciphers with ‘unsupported’ in OpenSSL 3.

Environment & Reproduction

Stream 9 ships OpenSSL 3.0 which moves MD5/RC4/legacy ciphers behind a provider.

Root Cause Analysis

Old PKCS#12 files and 3DES sessions need the legacy provider enabled.

Quick Triage

openssl list -providers shows active providers.

Step-by-Step Diagnosis

Reproduce with openssl pkcs12 -in old.p12 and observe error.

Solution – Primary Fix

Enable legacy provider in /etc/pki/tls/openssl.cnf [provider_sect] and activate=1.

Solution – Alternative Approaches

Convert artifacts: openssl pkcs12 -in old.p12 -nodes -out tmp.pem; rewrap with modern ciphers.

Verification & Acceptance Criteria

Application loads keys/certs and connects without errors.

Rollback Plan

Comment out the legacy provider section to restore defaults.

Prevention & Hardening

Rotate keys and standardize on AES-GCM/ChaCha20-Poly1305.

Related Errors & Cross-Refs

Related: crypto-policies DEFAULT vs LEGACY and gnutls priority.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSL 3 migration guide and Red Hat crypto docs.