romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-02 21:30:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

tests: avoid use of sha1 in certificates

Browse source 
The SHA-1 algorithm is deprecated (particularly for security-sensitive
applications) in a variety of OS environments. This already affects
RHEL-9 and derivatives, which are not willing to use certificates using
that algorithm. The fix is to use sha256 instead, which is already used
for most of the other certificates in the test suite.

Fixes #10135

This gets rid of issues related to sha1 signatures.

Manual steps after "make clean-certs" and "make build-certs":

- Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem
  (make clean-certs does not remove the original tests/stunnel.pem)

- Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey
  options of tests/data/test2041 and tests/data/test2087

Closes #10153
This commit is contained in:
Paul Howarth 2022-12-23 12:34:49 +00:00 • committed by Daniel Stenberg
parent 5ee81c3963
commit ef07452a5c
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
65 changed files with 1443 additions and 1490 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/certs/scripts/genroot.sh
View file

@ -63,8 +63,8 @@ set -e
echo SERIAL=$SERIAL PREFIX=$PREFIX DURATION=$DURATION KEYSIZE=$KEYSIZE
echo "openssl genrsa -out $PREFIX-ca.key $KEYSIZE -passout XXX"
openssl genrsa -out $PREFIX-ca.key $KEYSIZE -passout pass:secret
echo "openssl genrsa -out $PREFIX-ca.key -passout XXX $KEYSIZE"
openssl genrsa -out $PREFIX-ca.key -passout pass:secret $KEYSIZE
echo "openssl req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr"
$OPENSSL req -config $PREFIX-ca.prm -new -key $PREFIX-ca.key -out $PREFIX-ca.csr -passin pass:secret