Error in using dilithium as a signatures algorithm

[Nafisehhhh]

Hi. I use these commands for creating keys and certificates using dilithium2 instead of rsa:

• /usr/local/bin/openssl req -x509 -new -newkey dilithium2 -keyout dili_CA.key -out dili_CA.crt -nodes -subj "/CN=test CA" -days 365 -config /home/openssl-3.0.2/apps/openssl.cnf -provider-path /home/oqs-provider/_build/oqsprov -provider default -provider oqsprovider

• /usr/local/bin/openssl genpkey -algorithm dilithium2 -out dili_srv.key -provider-path /home/oqs-provider/_build/oqsprov -provider default -provider oqsprovider

• /usr/local/bin/openssl req -new -newkey dilithium2 -keyout dili_srv.key -out dili_srv.csr -nodes -subj "/CN=test server" -config /home/openssl-3.0.2/apps/openssl.cnf -provider-path /home/oqs-provider/_build/oqsprov -provider default -provider oqsprovider

• /usr/local/bin/openssl x509 -req -in dili_srv.csr -out dili_srv.crt -CA dili_CA.crt -CAkey dili_CA.key -CAcreateserial -days 365 -provider-path /home/oqs-provider/_build/oqsprov -provider default -provider oqsprovider

Next, in setting up server, I'm getting this error:

• Using default temp DH parameters
• error setting certificate
• 808279F96C7F0000:error:0A00018E:SSL
• routines:SSL_CTX_use_certificate:ca md too weak:ssl/ssl_rsa.c:221

I changed default_md in openssl.cnf to sha256, but error not fixed. How can I resolve this?

[baentsch]

While oqsprovider implements all required APIs (which is why cert-gen etc work), OpenSSL3 itself does not yet support provider-implemented ("pluggable") signature algorithms when running TLS, though: See openssl/openssl#10512

-> Therefore, some errors are not surprising. For running a TLS1.3 server please use oqs-openssl111 for the time being.

[baentsch]

@Nafisehhhh : There now is a resolution for the issue: A ready-to-run docker image is also available for testing: See here. Will mark the question answered if not getting further feedback from you, OK?