romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-02 02:30:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

tests: avoid use of sha1 in certificates

Browse source 
The SHA-1 algorithm is deprecated (particularly for security-sensitive
applications) in a variety of OS environments. This already affects
RHEL-9 and derivatives, which are not willing to use certificates using
that algorithm. The fix is to use sha256 instead, which is already used
for most of the other certificates in the test suite.

Fixes #10135

This gets rid of issues related to sha1 signatures.

Manual steps after "make clean-certs" and "make build-certs":

- Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem
  (make clean-certs does not remove the original tests/stunnel.pem)

- Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey
  options of tests/data/test2041 and tests/data/test2087

Closes #10153
This commit is contained in:
Paul Howarth 2022-12-23 12:34:49 +00:00 • committed by Daniel Stenberg
parent 5ee81c3963
commit ef07452a5c
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
65 changed files with 1443 additions and 1490 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/test2041
View file

@ -35,7 +35,7 @@ https Server-localhost-sv.pem
simple HTTPS GET with base64-sha256 public key pinning
</name>
<command>
--cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//d6NWnt6Q9+jU//Ak49bc7+k96pcarb3XjHYM8BMPxg0= https://localhost:%HTTPSPORT/%TESTNUMBER
--cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//AAUDLk4c98xcFUDvA9i/MnA9HuO03IPi15r+Cx9OXnc= https://localhost:%HTTPSPORT/%TESTNUMBER
</command>
# Ensure that we're running on localhost because we're checking the host name
<precheck>

2
tests/data/test2087
View file

@ -39,7 +39,7 @@ simple HTTPS GET with base64-sha256 public key pinning (Schannel variant)
CURL_SSL_BACKEND=schannel
</setenv>
<command>
--cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//d6NWnt6Q9+jU//Ak49bc7+k96pcarb3XjHYM8BMPxg0= --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
--cacert %SRCDIR/certs/EdelCurlRoot-ca.crt --pinnedpubkey sha256//AAUDLk4c98xcFUDvA9i/MnA9HuO03IPi15r+Cx9OXnc= --ssl-revoke-best-effort https://localhost:%HTTPSPORT/%TESTNUMBER
</command>
# Ensure that we're running on localhost because we're checking the host name
<precheck>