7.2 alpine images have a problematical libressl configuration

[t3easy]

Missing default_bits and default_md in /etc/ssl/openssl.cnf causes problems with openssl_pkey_new().

See, e.g.: https://forge.typo3.org/issues/83643

[yosifkit]

As I understand it, openssl_pkey_new can take values for private_key_bits and private_key_type.

$rsa_key = openssl_pkey_new([
	'private_key_bits' => 2048,
	'private_key_type' => OPENSSL_KEYTYPE_RSA
]);

var_dump($rsa_key);
# resource(1) of type (OpenSSL key)

If you are not passing these in and instead relying on the defaults of openssl.conf, then you should ensure that openssl.conf contains what you expect. If these defaults are required to be in openssl.conf then this is a packaging bug in the libressl package for Alpine and not something we should be changing in the image.

[t3easy]

As the 5.6, 7.0, 7.1 images with openssl have this values set it would be less breaking if they are set.

[tianon]

I'm still inclined to say this is a user/application issue, especially given the comment on https://secure.php.net/manual/en/function.openssl-pkey-new.php:

Note: You need to have a valid openssl.cnf installed for this function to operate correctly. See the notes under the installation section for more information.

We intentionally don't modify this configuration because it's not the image's responsibility to determine or dictate the security requirements of the applications of users of this image (and I'd definitely be choosing values that are likely higher than reasonable for most applications).

[t3easy]

So the current status is:
Every image, including Debian based 7.2 has a valid (but maybe not ideal) configuration of openssl.
Only Alpine based 7.2 images hasn't.
If it stays that way, maybe it is worth a note, because it's breaking.

[tianon]

I'm still inclined to strongly disagree with us providing anything in this configuration file -- folks really should be providing a more secure OpenSSL configuration than the default provided by the distribution, regardless of the distribution. It's somewhat tempting to remove openssl.cnf from all images to help nudge users into having to do so if they want to use this key-generating function.