warn on generation of DSA keys of over 1024 bits.

diff --git a/src/certtool.c b/src/certtool.c
index 516732398f39c3f6258c185478dbb14f6db50ef4..b456bf66ffc33736b643f00aee7cce7a3c263cef 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -252,14 +252,18 @@ generate_private_key_int (void)
   bits = get_bits (key_type);
 
   fprintf (stderr, "Generating a %d bit %s private key...\n",
-           get_bits (key_type), gnutls_pk_algorithm_get_name (key_type));
+           bits, gnutls_pk_algorithm_get_name (key_type));
 
   if (info.quick_random == 0)
     fprintf (stderr,
              "This might take several minutes depending on availability of randomness"
              " in /dev/random.\n");
 
-  ret = gnutls_x509_privkey_generate (key, key_type, get_bits (key_type), 0);
+  if (bits > 1024 && key_type == GNUTLS_PK_DSA)
+    fprintf (stderr,
+             "Note that DSA keys with size over 1024 can only be used with TLS 1.2 or later.\n\n");
+
+  ret = gnutls_x509_privkey_generate (key, key_type,bits, 0);
   if (ret < 0)
     error (EXIT_FAILURE, 0, "privkey_generate: %s", gnutls_strerror (ret));