Re: [Pki-devel] Fwd: [Freeipa-users] SHA-1 certificate support
Nalin Dahyabhai wrote:
On Wed, Oct 24, 2012 at 04:02:53PM -0400, Rob Crittenden wrote:
> I assume he'd have to modify a profile to do this?
There are two signatures when you're talking about using a CSR to
request a certificate from an external CA.
There's the digest used for the signature that the issuer includes in
the certificate. In Dogtag, I believe that the allowed types are
enumerated (by a signingAlgConstraint) in the profile, and the default
is specified (as "ca.signing.defaultSigningAlgorithm") in the CA's
CS.cfg file.
Someone please correct me if I'm looking at the wrong places there.
Then there's the digest used for the self-signature that the client
includes in the CSR. The IPA installs script uses certutil, and it
looks like certutil uses SHA1 by default. That's fine for this user,
but I'll note that we can apparently use certutil's (undocumented?) -Z
flag to switch that to something like SHA256.
The CSR is generated by dogtag. I'm not sure if it forks out to certutil
or not but I'd suspect it doesn't.
Can someone from the CS team confirm that changing the
defaultSigningAlgorithm is the right thing to do here?
rob