Re: s_client SECLEVEL different in config file vs command line?

On 9/21/25 4:33 AM, Viktor Dukhovni wrote:
> You're also overriding the default crypto policy,

And that's the key.  /usr/share/crypto-policies/DEFAULT/opensslcnf.txt
specifically disables SHA-1 signatures.

   [evp_properties]
   rh-allow-sha1-signatures = no

So by not including that file (through its /etc/crypto-policies
symlink), I've allowed them.  (This wouldn't work on RHEL or
derivatives, where 'rh-allow-sha1-signatures = yes' is required to
enable them.)

Annoyingly, it seems to be completely impossible to override this
setting from the command line, so a complete custom OpenSSL
configuration is required for every one-off test of an old server.

-- 
========================================================================
Google                                      Where SkyNet meets Idiocracy
========================================================================

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/10av27g%24obc%241%40ciao.gmane.io.