| Newsgroups |
php.bugs |
| Message-ID |
<[email protected]> |
Edit report at https://bugs.php.net/bug.php?id=74335&edit=1
ID: 74335
Comment by: [email protected]
Reported by: jmaguire at duo dot com
Summary: digest_alg configarg for openssl_csr_sign has no
effect
Status: Feedback
Type: Bug
Package: OpenSSL related
Operating System: Linux
PHP Version: 7.1.3
Block user comment: N
Private report: N
New Comment:
Your bug title says "openssl_csr_sign" doesn't obey "digest_alg", but you pass "digest_alg" to "openssl_csr_new" instead. It works fine if you pass the option to "openssl_csr_sign".
Unfortunately, the documentation just mentions all options for each and every function, while only some apply to each.
Previous Comments:
------------------------------------------------------------------------
[2017-03-29 15:53:32] [email protected]
https://security.stackexchange.com/a/67235/41073
tl;dr specifying digest_alg at openssl_csr_new() does not specify what should be used when signing the certificate, rather what should be used when signing the CSR itself.
Props to leigh for finding this.
------------------------------------------------------------------------
[2017-03-29 15:45:28] [email protected]
Thinking about it I'm not sure it actually makes sense to specify the algorithm at the point of creating a new CSR, surely that's up to the signing CA to determine?
When exported, a CSR does not (afaik?) contain this information, so logically it doesn't make sense to specify it here.
If what I said there ^ is correct (it may not be), I think this is a documentation issue more than anything else.
------------------------------------------------------------------------
[2017-03-29 15:37:21] [email protected]
The issue is that openssl_csr_sign() is not using the value defined in the CSR created with openssl_csr_new().
If you pass the ['digest_alg' => 'whatever'] config arg directly to openssl_csr_sign() then it works as expected.
------------------------------------------------------------------------
[2017-03-29 15:29:11] [email protected]
Does openssl_error_string() return anything? Note you should call it multiple times, like
while ($msg = openssl_error_string())
echo $msg . "<br />\n";
------------------------------------------------------------------------
[2017-03-29 15:10:15] jmaguire at duo dot com
PHP 5.6.17-3 (cli) exhibits the same behavior.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74335
--
Edit this bug report at https://bugs.php.net/bug.php?id=74335&edit=1