diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2018-09-19 09:04:48 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2018-09-20 09:06:21 +0200 |
| commit | ba782baac3009e44295589743bb8ae8220793e74 (patch) | |
| tree | 3f3904a63f34dea23ff4370bd32d25b2214b7436 /tests/certs/scripts/genroot.sh | |
| parent | 5c73093edb3bd527db9c8abdee53d0f18e6a4cc1 (diff) | |
certs: generate tests certs with sha256 digest algorithm
As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs:
"SSL certificate problem: CA signature digest algorithm too weak"
Closes #3014
Diffstat (limited to 'tests/certs/scripts/genroot.sh')
| -rwxr-xr-x | tests/certs/scripts/genroot.sh | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/tests/certs/scripts/genroot.sh b/tests/certs/scripts/genroot.sh index 4d2118aae..5dd9fac95 100755 --- a/tests/certs/scripts/genroot.sh +++ b/tests/certs/scripts/genroot.sh @@ -17,6 +17,8 @@ cd $HOME KEYSIZE=2048 DURATION=6000 +# The -sha256 option was introduced in OpenSSL 1.0.1 +DIGESTALGO=-sha256 PREFIX=$1 if [ ".$PREFIX" = . ] ; then @@ -46,9 +48,9 @@ openssl genrsa -out $PREFIX-ca.key $KEYSIZE -passout pass:secret echo "openssl req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr" $OPENSSL req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr -passin pass:secret -echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert -sha1 " +echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert $DIGESTALGO " -$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert -sha1 +$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert $DIGESTALGO echo "openssl x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert " $OPENSSL x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert |