OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

crypto: fix test cert generation to not use SHA1 algorithm

Browse Source 
GNUTLS 3.6.0 marked SHA1 as untrusted for certificates.
Unfortunately the gnutls_x509_crt_sign() method we are
using to create certificates in the test suite is fixed
to always use SHA1. We must switch to a different method
and explicitly ask for SHA256.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2017-08-29 17:03:30 +01:00
parent 8c0a6dc96c
commit 23c1595b02
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tests/crypto-tls-x509-helpers.c
View File

@ -406,7 +406,8 @@ test_tls_generate_cert(QCryptoTLSTestCertReq *req,
* If no 'ca' is set then we are self signing
* the cert. This is done for the root CA certs
*/
err = gnutls_x509_crt_sign(crt, ca ? ca : crt, privkey);
err = gnutls_x509_crt_sign2(crt, ca ? ca : crt, privkey,
GNUTLS_DIG_SHA256, 0);
if (err < 0) {
g_critical("Failed to sign certificate %s",
gnutls_strerror(err));