From a31b1b75cb6661661249174ecbc93ae4b1118f3a Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Mon, 5 Oct 2026 07:31:57 +0200 Subject: [PATCH] px5g-mbedtls: default to 2048 bit RSA keys px5g uses a 512 bit RSA key by default, for rsakey without a size and for selfsigned without -newkey. mbedtls 3.6 refuses to generate RSA keys smaller than MBEDTLS_RSA_GEN_KEY_MIN_BITS, which is 1024 bits, so both commands fail with "error: key generation failed". OpenWrt uses mbedtls 3.6 since 24.10. Use 2048 bits as the default RSA key size, like px5g-wolfssl and OpenSSL do. Signed-off-by: Josef Schlehofer Link: https://github.com/openwrt/openwrt/pull/25629 Signed-off-by: Robert Marko --- package/utils/px5g-mbedtls/Makefile | 2 +- package/utils/px5g-mbedtls/px5g-mbedtls.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/utils/px5g-mbedtls/Makefile b/package/utils/px5g-mbedtls/Makefile index 05038373880..217e37a70b4 100644 --- a/package/utils/px5g-mbedtls/Makefile +++ b/package/utils/px5g-mbedtls/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=px5g-mbedtls -PKG_RELEASE:=13 +PKG_RELEASE:=14 PKG_LICENSE:=LGPL-2.1 PKG_BUILD_FLAGS:=no-mips16 diff --git a/package/utils/px5g-mbedtls/px5g-mbedtls.c b/package/utils/px5g-mbedtls/px5g-mbedtls.c index 1e8711d66fc..4247a5790cc 100644 --- a/package/utils/px5g-mbedtls/px5g-mbedtls.c +++ b/package/utils/px5g-mbedtls/px5g-mbedtls.c @@ -157,7 +157,7 @@ static void gen_key(mbedtls_pk_context *key, bool rsa, int ksize, int exp, int dokey(bool rsa, char **arg) { mbedtls_pk_context key; - unsigned int ksize = 512; + unsigned int ksize = 2048; int exp = 65537; char *path = NULL; bool pem = true; @@ -212,7 +212,7 @@ int selfsigned(char **arg) size_t iplen; char *subject = ""; - unsigned int ksize = 512; + unsigned int ksize = 2048; int exp = 65537; unsigned int days = 30; char *keypath = NULL, *certpath = NULL;