Bug #74335 [Com]: digest_alg configarg for openssl_csr_sign has no effect

Edit report at https://bugs.php.net/bug.php?id=74335&edit=1

 ID:                 74335
 Comment by:         jmaguire at duo dot com
 Reported by:        jmaguire at duo dot com
 Summary:            digest_alg configarg for openssl_csr_sign has no
                     effect
 Status:             Open
 Type:               Bug
 Package:            OpenSSL related
 Operating System:   Linux
 PHP Version:        7.1.3
 Block user comment: N
 Private report:     N

 New Comment:

PHP 5.6.17-3 (cli) exhibits the same behavior.


Previous Comments:
------------------------------------------------------------------------
[2017-03-29 15:02:48] jmaguire at duo dot com

Description:
------------
The docs here (https://secure.php.net/openssl_csr_new) suggest that passing an array that contains "digest_alg" pointing to an algorithm (such as "sha256") will use the given signature algorithm. However, it has no effect.

Modifying the openssl.conf and setting "default_md" to "sha256" under the "[req]" header achieves the desired result.

Test script:
---------------
<?php

$privKey = openssl_pkey_new();
$csr = openssl_csr_new([
    'countryName' => 'US',
    'stateOrProvinceName' => 'MI',
    'localityName' => 'Ann Arbor',
    'organizationName' => 'Duo',
    'commonName' => 'localhost',
    'emailAddress' => '[email protected]'
], $privKey, ['digest_alg' => 'sha256']);
$ssCert = openssl_csr_sign($csr, null, $privKey, 30);

openssl_pkey_export($privKey, $contents);
file_put_contents('private.key', $contents);

openssl_x509_export($ssCert, $contents);
file_put_contents('public.crt', $contents);

Expected result:
----------------
Expect Signature Algorithm from openssl x509 to read "sha256WithRSAEncryption".

Actual result:
--------------
-> % openssl x509 -noout -text -in public.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = MI, L = Ann Arbor, O = Duo, CN = localhost, emailAddress = [email protected]
        Validity
            Not Before: Mar 29 14:56:56 2017 GMT
            Not After : Apr 28 14:56:56 2017 GMT
        Subject: C = US, ST = MI, L = Ann Arbor, O = Duo, CN = localhost, emailAddress = [email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cb:96:06:b8:72:36:8e:c7:88:89:d9:40:50:9d:
                    bf:27:07:9b:a3:54:85:54:eb:45:52:5a:8a:f0:b3:
                    22:85:14:51:55:18:0a:fb:a1:cd:93:a1:bf:94:4a:
                    fa:60:08:c0:98:ce:96:b5:e7:9f:ff:da:c4:3a:25:
                    a9:5e:5f:9b:ad:8d:fc:4f:47:16:c8:27:d2:df:96:
                    5f:d4:65:08:39:61:15:1b:c0:c6:ad:85:98:88:98:
                    67:c1:2c:d3:1d:ee:dd:82:3e:8d:9e:9e:17:98:9a:
                    f6:db:d7:34:f0:21:11:d4:40:a8:57:e0:de:c6:d7:
                    64:e2:d6:c5:d0:8f:dd:b0:0b:9e:55:70:b1:11:ab:
                    c0:4e:df:5e:7d:14:e5:b6:d9:36:03:65:62:be:a8:
                    bf:fd:ac:9b:b6:d5:50:e7:bc:0e:5a:0e:d8:f3:89:
                    7b:ed:aa:57:33:40:6c:95:cf:a5:22:01:59:43:be:
                    ff:bb:9a:e6:01:63:ba:f6:42:04:b7:6a:f9:c2:e0:
                    8e:f8:82:f9:5a:21:5d:fe:ae:e2:61:83:e2:f4:3b:
                    b9:82:d3:4c:ab:c5:83:c6:f4:53:93:1b:52:63:2c:
                    d4:5e:bb:00:92:67:91:51:34:be:50:30:a4:8d:f3:
                    3e:6e:e2:49:48:e0:44:8e:c6:1c:6b:11:e3:38:56:
                    aa:a1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2F:B1:AB:14:8F:C5:B0:9C:54:B6:11:9E:42:15:87:AD:48:E8:29:A2
            X509v3 Authority Key Identifier:
                keyid:2F:B1:AB:14:8F:C5:B0:9C:54:B6:11:9E:42:15:87:AD:48:E8:29:A2

            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
         51:49:f3:70:5a:55:32:e3:46:f8:af:1f:fc:54:cd:22:ac:85:
         9b:9e:87:67:36:9c:7b:ac:70:cd:ae:8e:33:ce:29:94:fe:af:
         1b:4d:5e:8a:53:65:d2:a9:1b:21:84:54:fd:b5:16:ca:54:aa:
         3c:3b:00:14:dc:53:d9:33:b1:5c:b9:aa:c9:5f:40:a2:e6:ce:
         c4:b2:5c:ec:e2:cb:58:48:8e:0e:8e:c0:c9:03:92:c8:2f:be:
         8a:84:f7:90:4e:87:43:58:30:43:8d:84:c6:48:4d:2f:4d:c8:
         67:ee:a1:fc:97:e9:dc:10:c2:ea:fc:ff:2c:30:28:79:01:33:
         7e:13:ec:05:d6:93:84:96:3d:ad:e9:8a:a3:07:2e:9d:18:69:
         77:c7:f3:9c:1b:54:a9:e7:f6:74:00:27:9d:30:a8:4e:57:0b:
         0e:20:a1:56:e5:37:b9:d7:2c:6c:65:5d:e0:ae:83:6f:36:f4:
         62:fb:1c:4d:ae:db:5e:ba:03:50:13:df:c2:e9:a9:26:f2:f7:
         b5:a7:4f:ed:7b:fb:1a:52:45:da:83:a8:14:0f:55:a5:93:bb:
         cf:2d:cb:4a:23:63:d2:38:45:f1:ab:eb:2b:01:0d:2d:fe:36:
         10:27:4c:6a:13:79:42:70:30:ce:74:39:e3:86:7b:26:04:09:
         b1:bd:12:a1


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74335&edit=1