The list of available crypto policies should also check against the available crypto-policy submodules

[michael-riddle]

Users should be able to ensure their crypto-policy is set to something like "FIPS:OSPP". The module should check for a colon in the ensure and then subsequently check if the submodule listed is available within /usr/share/crypto-policies/policies/modules. Reliant on simp/pupmod-simp-simplib#268 being finished.

[qateey]

adding support for this, RHEL 6 hosts cannot ssh into RHEL 9 hosts and as per https://access.redhat.com/solutions/6816771, one of the solutions is to set the crypto_policy as DEFAULT:SHA1 which is not possible with the current module

[Trabi11]

adding support for this, RHEL 6 hosts cannot ssh into RHEL 9 hosts and as per https://access.redhat.com/solutions/6816771, one of the solutions is to set the crypto_policy as DEFAULT:SHA1 which is not possible with the current module

Almost the same problem here. I have a RHEL 9 apache proxy which has to handle SHA1 signed OCSP responses and I'd like to set them to "DEFAULT:SHA1" instead of LEGACY. This unfortunately does not work even with "validate_policy => false".

As far as I can interpret, this parameter (validate_policy) is ignored anyway or at least I could not find any references to this variable that prevents the policy from being validated.