CentOS Stream 10 – Common Problem 235 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Legacy applications cannot negotiate TLS, returning handshake_failure or no shared cipher errors.

Environment & Reproduction

Common when integrating older appliances with CentOS Stream 10 that defaults to DEFAULT policy.

Root Cause Analysis

System-wide crypto policy disables TLS 1.0/1.1 and weak ciphers required by the legacy peer.

Quick Triage

Inspect update-crypto-policies –show and openssl ciphers output against the peer requirements.

Step-by-Step Diagnosis

Run: update-crypto-policies –show; openssl s_client -connect host:443 -tls1_2.

Solution – Primary Fix

Run: sudo update-crypto-policies –set LEGACY; sudo systemctl restart affected.service.

Solution – Alternative Approaches

Apply per-application overrides with crypto-policies subpolicies instead of weakening the system.

Verification & Acceptance Criteria

Legacy peer negotiates TLS successfully and update-crypto-policies –show reports the expected mode.

Rollback Plan

Run update-crypto-policies –set DEFAULT to revert if the legacy peer is decommissioned.

Prevention & Hardening

Plan upgrades of legacy endpoints and prefer subpolicies rather than LEGACY system-wide.

Related Errors & Cross-Refs

Linked to OCSP stapling, certificate algorithm errors, and SSH key exchange failures.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

crypto-policies(7) and Red Hat security hardening guide.