From: Andrew Bartlett Date: Wed, 9 Aug 2017 04:44:24 +0000 (+1200) Subject: s4/lib/tls: Use SHA256 to sign the TLS certificates X-Git-Tag: tdb-1.3.15~88 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5bb341fb9ceb943b4a72108edee9046b60f070b0;p=thirdparty%2Fsamba.git s4/lib/tls: Use SHA256 to sign the TLS certificates The use of SHA-1 has been on the "do not" list for a while now, so make our self-signed certificates use SHA256 using the new gnutls_x509_crt_sign2 provided since GNUTLS 1.2.0 Signed-off-by: Andrew Bartlett Reviewed-by: Garming Sam BUG: https://bugzilla.samba.org/show_bug.cgi?id=12953 --- diff --git a/source4/lib/tls/tlscert.c b/source4/lib/tls/tlscert.c index f1808d7cfd9..db4f2946ad4 100644 --- a/source4/lib/tls/tlscert.c +++ b/source4/lib/tls/tlscert.c @@ -106,7 +106,8 @@ void tls_cert_generate(TALLOC_CTX *mem_ctx, #if HAVE_GNUTLS_X509_CRT_SET_SUBJECT_KEY_ID TLSCHECK(gnutls_x509_crt_set_subject_key_id(cacrt, keyid, keyidsize)); #endif - TLSCHECK(gnutls_x509_crt_sign(cacrt, cacrt, cakey)); + TLSCHECK(gnutls_x509_crt_sign2(cacrt, cacrt, cakey, + GNUTLS_DIG_SHA256, 0)); DEBUG(3,("Generating TLS certificate\n")); TLSCHECK(gnutls_x509_crt_init(&crt)); @@ -132,8 +133,10 @@ void tls_cert_generate(TALLOC_CTX *mem_ctx, #if HAVE_GNUTLS_X509_CRT_SET_SUBJECT_KEY_ID TLSCHECK(gnutls_x509_crt_set_subject_key_id(crt, keyid, keyidsize)); #endif - TLSCHECK(gnutls_x509_crt_sign(crt, crt, key)); - TLSCHECK(gnutls_x509_crt_sign(crt, cacrt, cakey)); + TLSCHECK(gnutls_x509_crt_sign2(crt, crt, key, + GNUTLS_DIG_SHA256, 0)); + TLSCHECK(gnutls_x509_crt_sign2(crt, cacrt, cakey, + GNUTLS_DIG_SHA256, 0)); DEBUG(3,("Exporting TLS keys\n"));