diff options
author | Daniel Stenberg <daniel@haxx.se> | 2018-09-19 09:04:48 +0200 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2018-09-20 09:06:21 +0200 |
commit | ba782baac3009e44295589743bb8ae8220793e74 (patch) | |
tree | 3f3904a63f34dea23ff4370bd32d25b2214b7436 /tests/certs/scripts | |
parent | 5c73093edb3bd527db9c8abdee53d0f18e6a4cc1 (diff) |
certs: generate tests certs with sha256 digest algorithm
As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs:
"SSL certificate problem: CA signature digest algorithm too weak"
Closes #3014
Diffstat (limited to 'tests/certs/scripts')
-rwxr-xr-x | tests/certs/scripts/genroot.sh | 6 | ||||
-rwxr-xr-x | tests/certs/scripts/genserv.sh | 6 |
2 files changed, 8 insertions, 4 deletions
diff --git a/tests/certs/scripts/genroot.sh b/tests/certs/scripts/genroot.sh index 4d2118aae..5dd9fac95 100755 --- a/tests/certs/scripts/genroot.sh +++ b/tests/certs/scripts/genroot.sh @@ -17,6 +17,8 @@ cd $HOME KEYSIZE=2048 DURATION=6000 +# The -sha256 option was introduced in OpenSSL 1.0.1 +DIGESTALGO=-sha256 PREFIX=$1 if [ ".$PREFIX" = . ] ; then @@ -46,9 +48,9 @@ openssl genrsa -out $PREFIX-ca.key $KEYSIZE -passout pass:secret echo "openssl req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr" $OPENSSL req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr -passin pass:secret -echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert -sha1 " +echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL.ca-cacert $DIGESTALGO " -$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert -sha1 +$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-ca.prm -days $DURATION -req -signkey $PREFIX-ca.key -in $PREFIX-ca.csr -out $PREFIX-$SERIAL-ca.cacert $DIGESTALGO echo "openssl x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert " $OPENSSL x509 -text -in $PREFIX-$SERIAL-ca.cacert -nameopt multiline > $PREFIX-ca.cacert diff --git a/tests/certs/scripts/genserv.sh b/tests/certs/scripts/genserv.sh index 488d770f6..99f44ccee 100755 --- a/tests/certs/scripts/genserv.sh +++ b/tests/certs/scripts/genserv.sh @@ -17,6 +17,8 @@ cd $HOME KEYSIZE=2048 DURATION=3000 +# The -sha256 option was introduced in OpenSSL 1.0.1 +DIGESTALGO=-sha256 REQ=YES P12=NO @@ -81,9 +83,9 @@ $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem" $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem -echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt " +echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt " -$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt +$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt if [ "$P12." = YES. ] ; then |