I’ve just set up an AlmaLinux 10.2 virtual machine, and have set the crypto policy to FUTURE. I need to install the Apache web server, and I need to do it after setting the setting the crypto policy to FUTURE in order for FUTURE mode to work with Apache. But, while the repositories work fine in DEFAULT mode, I can’t access them in FUTURE mode. Here’s what I get when I try:
donnie@localhost:~$ sudo dnf install httpd mod_ssl
[sudo] password for donnie:
Last metadata expiration check: 3:12:37 ago on Thu 04 Jun 2026 08:27:50 AM EDT.
Dependencies resolved.
Package Architecture Version Repository Size
Installing:
httpd x86_64_v2 2.4.63-13.el10_2.1 appstream 47 k
mod_ssl x86_64_v2 1:2.4.63-13.el10_2.1 appstream 108 k
Installing dependencies:
almalinux-logos-httpd noarch 100.4-1.el10_2 appstream 18 k
apr x86_64_v2 1.7.5-3.el10 appstream 128 k
apr-util x86_64_v2 1.6.3-23.el10_1 appstream 97 k
apr-util-lmdb x86_64_v2 1.6.3-23.el10_1 appstream 13 k
httpd-core x86_64_v2 2.4.63-13.el10_2.1 appstream 1.4 M
httpd-filesystem noarch 2.4.63-13.el10_2.1 appstream 14 k
httpd-tools x86_64_v2 2.4.63-13.el10_2.1 appstream 81 k
Installing weak dependencies:
apr-util-openssl x86_64_v2 1.6.3-23.el10_1 appstream 15 k
mod_http2 x86_64_v2 2.0.29-4.el10_2 appstream 161 k
mod_lua x86_64_v2 2.4.63-13.el10_2.1 appstream 59 k
Transaction Summary
Install 12 Packages
Total download size: 2.1 M
Installed size: 6.3 M
Is this ok [y/N]: y
Downloading Packages:
[ === ] — B/s | 0 B --:-- ETA
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing ‘dnf clean packages’.
Error: Error downloading packages:
Curl error (35): SSL connect error for https://mirrors.almalinux.org/mirrorlist/10/appstream?arch=x86_64_v2 [TLS connect error: error:00000000:lib(0)::reason(0)]
donnie@localhost:~$
This looks like a system-wide crypto policy compatibility issue, not an Apache issue.
FUTURE also affects clients such as dnf / curl, because the crypto policy applies to TLS and other crypto backends system-wide. Red Hat documents that FUTURE is stricter and may cause interoperability problems on the public internet.
There is also a similar AlmaLinux mirrors issue:
So I would install the packages with DEFAULT, then switch back to FUTURE and reboot:
I do not think Apache has to be installed while the system is already in FUTURE mode. The policy is applied at runtime by the system crypto libraries, not baked into the RPM when it is installed.
Yeah, I know that the problem is a system-wide problem, due to the repository certificates not being compatible with FUTURE mode. So, my question is about that, and not specifically about Apache. But, this does impact how I’m able to use Apache.
The way Apache works, is that if I install it while the machine is in DEFAULT mode and then shift to FUTURE mode, Apache will refuse to start. With AlmaLinux 9, the repository certificates were compatible with FUTURE mode, so I could install Apache while in FUTURE mode, and everything would work fine. Before I learned that this would be an issue, I had installed Apache on AlmaLinux 9 while in DEFAULT mode, then shifted to FUTURE mode. That’s when I learned that Apache won’t start if when I do the setup in that order.
I never did figure out why Apache behaves this way. It seems logical that it wouldn’t matter, but it does. The only thing I can guess is that perhaps Apache gets installed with a different configuration when installed under DEFAULT mode than it does under FUTURE mode. But, I can’t say for sure.
Anyway, to show you what I mean, here’s what happens when I install Apache in DEFAULT mode, shift to FUTURE mode, and then try to start Apache:
donnie@alma-future:~$ sudo update-crypto-policies --show
[sudo] password for donnie:
FUTURE
donnie@alma-future:~$ sudo systemctl start httpd
Job for httpd.service failed because the control process exited with error code.
See “systemctl status httpd.service” and “journalctl -xeu httpd.service” for details.
donnie@alma-future:~$ sudo journalctl -xeu httpd.service
Jun 05 14:59:55 alma-future systemd[1]: Failed to start httpd.service - The Apache HTTP Server.
░░ Subject: A start job for unit httpd.service has failed
░░ Defined-By: systemd
░░ Support: Help and Support | AlmaLinux Wiki
░░
░░ A start job for unit httpd.service has finished with a failure.
░░
░░ The job identifier is 1223 and the job result is failed.
Again, if I could have installed Apache with the machine already in FUTURE mode, as I can with AlmaLinux 9, Apache would have started just fine.
Okay, here’s a follow-up to my first response. After a long chat with my buddy, Claude–ClaudeAI, that is–and running through lot of diagnostic commands to figure out the problem, we’ve discovered that there’s apparently nothing we can do to make an Alma 10 machine access the repositories while in FUTURE mode, due to multiple different problems.
However, I found that the only problem with Apache is that installing it while in DEFAULT mode causes it to generate a “localhost.crt” certificate with a 2048-bit key, and FUTURE mode requires Apache to use a 3072-bit key. Generating a certificate with a 3072-bit key fixes the Apache problem.
So, I think that we can consider this issue closed, since there’s nothing that anyone can do until the repository mirrors become compatible with FUTURE mode.