| Age | Commit message (Collapse) | Author |
|---|
|
As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs:
"SSL certificate problem: CA signature digest algorithm too weak"
Closes #3014
|
|
The previous test certificates contained RSA keys of only 1024 bits.
However, RSA claims that 1024-bit RSA keys are likely to become
crackable some time before 2010. The NIST recommends at least 2048-bit
keys for RSA for now.
Better use full 2048 also for testing.
Closes #2973
|
|
Closes #1356
|
|
|
|
The certificate generation scripts were also updated to better match the
format of the certificates currently checked in.
|
|
|
|
Option --pinnedpubkey takes a path to a public key in DER format and
only connect if it matches (currently only implemented with OpenSSL).
Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt().
Extract a public RSA key from a website like so:
openssl s_client -connect google.com:443 2>&1 < /dev/null | \
sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \
| openssl rsa -pubin -outform DER > google.com.der
|
|
|
|
|
|
... and make it possible to do so without any user interaction
|
|
|
|
each test, so that the test suite can now be used to actually test the
verification of cert names etc. This made an error show up in the OpenSSL-
specific code where it would attempt to match the CN field even if a
subjectAltName exists that doesn't match. This is now fixed and verified
in test 311.
|
