Re: ssh error invalid digest

On Sun, Jun 28, 2026 at 06:18:42PM -0400, Tom Goodman wrote:

> Can openssl 3.5.71-1 be coerced to connect to an old ssh server?

The "3.5.71-1" is a vendor-specific version number.  You can ask your
vendor about that version.  The latest upstream OpenSSL 3.5 patch
release is openssl-3.5.7.

>     $ ssh -o HostKeyAlgorithms=3D+ssh-rsa notsure
>     ssh_dispatch_run_fatal: Connection to 192.168.11.3 port 22: error in =
libcrypto: invalid digest

You'll need to explain in more detail specifically which digest the SSH
client is attempting to use.  With "ssh-rsa" I'd expect RSA with SHA1,
which still works in OpenSSL 3.5.7.  Demo in a fresh build tree with
a 2048 bit RSA key:

    $ ./util/wrap.pl ./apps/openssl dgst -sha1 \
        -sign test/certs/serverkey.pem <(printf foo) | wc -c
    256

    $ ./util/wrap.pl ./apps/openssl dgst -sha1 \
        -sign test/certs/serverkey.pem <(printf foo) |
        ./util/wrap.pl ./apps/openssl dgst -sha1 -signature /dev/stdin \
            -verify test/certs/serverkey.pem <(printf foo)
    Verified OK

So SHA1 with RSA produces the expected signature length =3D modulus
length, and verifies OK.

> libcrypto: invalid digest

You'll need to figure out whether your code is linked with the right
libcrypto, and what digest it is trying and failing to compute or
verify.

> Can openssl 3.5.71-1 be coerced to make the connection to this old ssh
> server? If so, what options?

Well, that's a question for your vendor, perhaps they've disabled SHA1
in this build, or made other changes.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/akKsVz1NpkVuWI_3%40chardros.imrryr.org.