From ba782baac3009e44295589743bb8ae8220793e74 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 19 Sep 2018 09:04:48 +0200 Subject: certs: generate tests certs with sha256 digest algorithm As OpenSSL 1.1.1 starts to complain and fail on sha1 CAs: "SSL certificate problem: CA signature digest algorithm too weak" Closes #3014 --- tests/certs/scripts/genserv.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'tests/certs/scripts/genserv.sh') diff --git a/tests/certs/scripts/genserv.sh b/tests/certs/scripts/genserv.sh index 488d770f6..99f44ccee 100755 --- a/tests/certs/scripts/genserv.sh +++ b/tests/certs/scripts/genserv.sh @@ -17,6 +17,8 @@ cd $HOME KEYSIZE=2048 DURATION=3000 +# The -sha256 option was introduced in OpenSSL 1.0.1 +DIGESTALGO=-sha256 REQ=YES P12=NO @@ -81,9 +83,9 @@ $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform DER -out $PREFIX-sv.pub.der echo "openssl rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem" $OPENSSL rsa -in $PREFIX-sv.key -pubout -outform PEM -out $PREFIX-sv.pub.pem -echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt " +echo "openssl x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt " -$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline -sha1 > $PREFIX-sv.crt +$OPENSSL x509 -set_serial $SERIAL -extfile $PREFIX-sv.prm -days $DURATION -CA $CAPREFIX-ca.cacert -CAkey $CAPREFIX-ca.key -in $PREFIX-sv.csr -req -text -nameopt multiline $DIGESTALGO > $PREFIX-sv.crt if [ "$P12." = YES. ] ; then -- cgit v1.2.3