When FIPS mode is on, gnutls_dh_params_generate2 will fail if 1024 is specified as the prime's number of bits, a bigger value works in both cases. Signed-off-by: Giuseppe Scrivano <gscrivan(a)redhat.com&gt; --- with the development version of GNU TLS is possible to test FIPS mode setting the env variable GNUTLS_FORCE_FIPS_MODE=2 src/rpc/virnettlscontext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 31aac9d..947038d 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -43,7 +43,7 @@ #include "virthread.h" #include "configmake.h" -#define DH_BITS 1024 +#define DH_BITS 2048 #define LIBVIRT_PKI_DIR SYSCONFDIR "/pki" #define LIBVIRT_CACERT LIBVIRT_PKI_DIR "/CA/cacert.pem" -- 1.9.3