Edit report at https://bugs.php.net/bug.php?id=74335&edit=1
ID: 74335
Updated by: [email protected]
Reported by: jmaguire at duo dot com
Summary: digest_alg configarg for openssl_csr_sign has no
effect
-Status: Open
+Status: Feedback
Type: Bug
Package: OpenSSL related
Operating System: Linux
PHP Version: 7.1.3
Block user comment: N
Private report: N
New Comment:
Does openssl_error_string() return anything? Note you should call it multiple times, like
while ($msg = openssl_error_string())
echo $msg . "<br />\n";
Previous Comments:
------------------------------------------------------------------------
[2017-03-29 15:10:15] jmaguire at duo dot com
PHP 5.6.17-3 (cli) exhibits the same behavior.
------------------------------------------------------------------------
[2017-03-29 15:02:48] jmaguire at duo dot com
Description:
------------
The docs here (https://secure.php.net/openssl_csr_new) suggest that passing an array that contains "digest_alg" pointing to an algorithm (such as "sha256") will use the given signature algorithm. However, it has no effect.
Modifying the openssl.conf and setting "default_md" to "sha256" under the "[req]" header achieves the desired result.
Test script:
---------------
<?php
$privKey = openssl_pkey_new();
$csr = openssl_csr_new([
'countryName' => 'US',
'stateOrProvinceName' => 'MI',
'localityName' => 'Ann Arbor',
'organizationName' => 'Duo',
'commonName' => 'localhost',
'emailAddress' => '[email protected]'
], $privKey, ['digest_alg' => 'sha256']);
$ssCert = openssl_csr_sign($csr, null, $privKey, 30);
openssl_pkey_export($privKey, $contents);
file_put_contents('private.key', $contents);
openssl_x509_export($ssCert, $contents);
file_put_contents('public.crt', $contents);
Expected result:
----------------
Expect Signature Algorithm from openssl x509 to read "sha256WithRSAEncryption".
Actual result:
--------------
-> % openssl x509 -noout -text -in public.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C = US, ST = MI, L = Ann Arbor, O = Duo, CN = localhost, emailAddress = [email protected]
Validity
Not Before: Mar 29 14:56:56 2017 GMT
Not After : Apr 28 14:56:56 2017 GMT
Subject: C = US, ST = MI, L = Ann Arbor, O = Duo, CN = localhost, emailAddress = [email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cb:96:06:b8:72:36:8e:c7:88:89:d9:40:50:9d:
bf:27:07:9b:a3:54:85:54:eb:45:52:5a:8a:f0:b3:
22:85:14:51:55:18:0a:fb:a1:cd:93:a1:bf:94:4a:
fa:60:08:c0:98:ce:96:b5:e7:9f:ff:da:c4:3a:25:
a9:5e:5f:9b:ad:8d:fc:4f:47:16:c8:27:d2:df:96:
5f:d4:65:08:39:61:15:1b:c0:c6:ad:85:98:88:98:
67:c1:2c:d3:1d:ee:dd:82:3e:8d:9e:9e:17:98:9a:
f6:db:d7:34:f0:21:11:d4:40:a8:57:e0:de:c6:d7:
64:e2:d6:c5:d0:8f:dd:b0:0b:9e:55:70:b1:11:ab:
c0:4e:df:5e:7d:14:e5:b6:d9:36:03:65:62:be:a8:
bf:fd:ac:9b:b6:d5:50:e7:bc:0e:5a:0e:d8:f3:89:
7b:ed:aa:57:33:40:6c:95:cf:a5:22:01:59:43:be:
ff:bb:9a:e6:01:63:ba:f6:42:04:b7:6a:f9:c2:e0:
8e:f8:82:f9:5a:21:5d:fe:ae:e2:61:83:e2:f4:3b:
b9:82:d3:4c:ab:c5:83:c6:f4:53:93:1b:52:63:2c:
d4:5e:bb:00:92:67:91:51:34:be:50:30:a4:8d:f3:
3e:6e:e2:49:48:e0:44:8e:c6:1c:6b:11:e3:38:56:
aa:a1
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
2F:B1:AB:14:8F:C5:B0:9C:54:B6:11:9E:42:15:87:AD:48:E8:29:A2
X509v3 Authority Key Identifier:
keyid:2F:B1:AB:14:8F:C5:B0:9C:54:B6:11:9E:42:15:87:AD:48:E8:29:A2
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
51:49:f3:70:5a:55:32:e3:46:f8:af:1f:fc:54:cd:22:ac:85:
9b:9e:87:67:36:9c:7b:ac:70:cd:ae:8e:33:ce:29:94:fe:af:
1b:4d:5e:8a:53:65:d2:a9:1b:21:84:54:fd:b5:16:ca:54:aa:
3c:3b:00:14:dc:53:d9:33:b1:5c:b9:aa:c9:5f:40:a2:e6:ce:
c4:b2:5c:ec:e2:cb:58:48:8e:0e:8e:c0:c9:03:92:c8:2f:be:
8a:84:f7:90:4e:87:43:58:30:43:8d:84:c6:48:4d:2f:4d:c8:
67:ee:a1:fc:97:e9:dc:10:c2:ea:fc:ff:2c:30:28:79:01:33:
7e:13:ec:05:d6:93:84:96:3d:ad:e9:8a:a3:07:2e:9d:18:69:
77:c7:f3:9c:1b:54:a9:e7:f6:74:00:27:9d:30:a8:4e:57:0b:
0e:20:a1:56:e5:37:b9:d7:2c:6c:65:5d:e0:ae:83:6f:36:f4:
62:fb:1c:4d:ae:db:5e:ba:03:50:13:df:c2:e9:a9:26:f2:f7:
b5:a7:4f:ed:7b:fb:1a:52:45:da:83:a8:14:0f:55:a5:93:bb:
cf:2d:cb:4a:23:63:d2:38:45:f1:ab:eb:2b:01:0d:2d:fe:36:
10:27:4c:6a:13:79:42:70:30:ce:74:39:e3:86:7b:26:04:09:
b1:bd:12:a1
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74335&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.