Switching system-wide crypto policies on RHEL with update-crypto-policies

Goal

Inspect and change the crypto policy that constrains default algorithms and protocol versions across the OS, rather than hand-editing each application.

Prerequisites

Root or sudo access; a maintenance window, since a stricter policy can immediately break interoperability with older peers.

Steps

1. Show the active policy:

update-crypto-policies --show

2. Pick a named policy. crypto-policies(7) documents four: DEFAULT (broadly compatible), LEGACY (interoperate with old peers, weaker), FUTURE (stricter, forward-looking), and FIPS. Subpolicies can be layered on a named policy — for example DEFAULT:SHA1 to selectively re-permit something DEFAULT forbids.
3. Switch policy — the tool's own --set option applies it:

update-crypto-policies --set FUTURE

For FIPS specifically, treat --set FIPS as necessary but not always sufficient by itself for a compliance-relevant deployment; check the current release's own FIPS guidance for additional steps such as a kernel FIPS flag and reboot. 4. Restart or re-login. Already-running processes read the policy at their own startup, so the change applies to new processes; restart TLS-terminating and SSH services explicitly (systemctl restart sshd, and the equivalent for any TLS-terminating service), or reboot to guarantee every long-running daemon picks it up. 5. Verify with --show again, and by attempting a connection using an algorithm the new policy should now reject.

Expected result

update-crypto-policies --show prints the new policy name; a restarted service refuses a handshake using an algorithm the new policy excludes.

Limits and test basis

This sets the OS-level default; an application with its own explicit cipher configuration can still override it, so the absence of an error does not prove every service is actually constrained — check each service that matters individually. Rolling back is update-crypto-policies --set DEFAULT followed by restarting the same services. Command flags are confirmed from the crypto-policies project's own source, which RHEL 8, 9 and 10 all ship from the same upstream.