diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2015-03-16 18:25:22 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2015-03-23 17:22:31 +0100 |
| commit | ae0604f58334c72f9969fdc1a6425adb948da0e9 (patch) | |
| tree | 13a634c61a531391a93e8de6d4aca385ba0899a1 /src/pki/commands/signcrl.c | |
| parent | 7fa03b308cb73c68ea7e944fcbc19073d3a3f5fa (diff) | |
| download | strongswan-ae0604f58334c72f9969fdc1a6425adb948da0e9.tar.bz2 strongswan-ae0604f58334c72f9969fdc1a6425adb948da0e9.tar.xz | |
pki: Use SHA-256 as default for signatures
Since the BLISS private key supports this we don't do any special
handling anymore (if the user choses a digest that is not supported,
signing will simply fail later because no signature scheme will be found).
Diffstat (limited to 'src/pki/commands/signcrl.c')
| -rw-r--r-- | src/pki/commands/signcrl.c | 12 |
1 files changed, 2 insertions, 10 deletions
diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c index 4b81c775c..aa403229f 100644 --- a/src/pki/commands/signcrl.c +++ b/src/pki/commands/signcrl.c @@ -117,7 +117,7 @@ static int sign_crl() certificate_t *ca = NULL, *crl = NULL; crl_t *lastcrl = NULL; x509_t *x509; - hash_algorithm_t digest = HASH_SHA1; + hash_algorithm_t digest = HASH_SHA256; char *arg, *cacert = NULL, *cakey = NULL, *lastupdate = NULL, *error = NULL; char *basecrl = NULL; char serial[512], *keyid = NULL; @@ -335,14 +335,6 @@ static int sign_crl() error = "CA private key does not match CA certificate"; goto error; } - if (private->get_type(private) == KEY_BLISS) - { - /* the default hash function is SHA512. SHA1 is not supported */ - if (digest == HASH_SHA1) - { - digest = HASH_SHA512; - } - } if (basecrl) { @@ -473,7 +465,7 @@ static void __attribute__ ((constructor))reg() {"serial", 's', 1, "hex encoded certificate serial number to revoke"}, {"reason", 'r', 1, "reason for certificate revocation"}, {"date", 'd', 1, "revocation date as unix timestamp, default: now"}, - {"digest", 'g', 1, "digest for signature creation, default: sha1"}, + {"digest", 'g', 1, "digest for signature creation, default: sha256"}, {"outform", 'f', 1, "encoding of generated crl, default: der"}, } }); |