EL 8: System-wide crypto policies

EL 8 introduces system-wide crypto policies: with one update-crypto-policies command you set the allowed protocol versions and algorithm strength for OpenSSL, GnuTLS, OpenSSH, NSS, libssh, and friends at once. Before this, every component had its own configuration files, and “disable weak algorithms everywhere” was an engineering project scattered across many places.

What changed

Policies are expressed as levels, living under /etc/crypto-policies/:

Level	Meaning
LEGACY	compatibility with old devices (keeps SHA-1, TLS 1.0/1.1, …)
DEFAULT	balance of security and compatibility (EL 8 default)
FUTURE	stricter choices aimed forward
FIPS	the subset satisfying FIPS 140 requirements
(sub-policies)	fine-tuning overlays such as DEFAULT:SHA1 or AD-SUPPORT

Each crypto component ships a backend configuration file (for example /etc/crypto-policies/back-ends/opensslcnf.config) that it reads at startup; update-crypto-policies --set only switches one global selection, and every component follows.

This mechanism became the foundation of the EL security story: EL 9’s OpenSSL 3.0 providers and EL 10’s default SHA-1 ban are layers stacked on top of it.

EL 7 vs EL 8

Item	EL 7	EL 8
Algorithm-strength configuration	per-component files	unified crypto-policies
Switching command	none	update-crypto-policies --set …
Showing the current policy	none	update-crypto-policies --show
FIPS compliance	manual configuration	FIPS level + fips-mode-setup

What it means for you

• Operations: enforcing a security baseline goes from “edit N config files” to one command plus restarting affected services; audits gain a single source of truth.
• Legacy devices: when interfacing with devices that only speak TLS 1.0/1.1 or SHA-1 signatures, evaluate the cost of LEGACY or a sub-policy first, instead of loosening components one by one.
• Developers: applications that hardcode algorithms (bypassing component defaults) are unaffected by the policy — on EL 8+ such code is a liability.

Note

Policy changes do not apply to already established connections; the relevant services or sessions must be restarted. Validate legacy-client handshakes in staging before switching in production.

Usage

Show and switch the policy

update-crypto-policies --show
sudo update-crypto-policies --set FUTURE

FIPS mode (a separate switch)

sudo fips-mode-setup --enable
sudo fips-mode-setup --check

For the full FIPS procedure and validation, see FIPS mode.

Further reading

• FIPS mode — the FIPS level and compliance validation
• EL 9: OpenSSL 3.0 — how the provider architecture cooperates with policies
• EL 10: Post-quantum cryptography — the next step for the policy system
• SSH hardening — algorithm enforcement on the OpenSSH side