Bug #74335 [Fbk->Csd]: digest_alg configarg for openssl_csr_sign has no effect
[email protected] ("jmaguire at duo dot com")
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Edit report at https://bugs.php.net/bug.php?id=74335&edit=1
ID: 74335
User updated by: jmaguire at duo dot com
Reported by: jmaguire at duo dot com
Summary: digest_alg configarg for openssl_csr_sign has no
effect
-Status: Feedback
+Status: Closed
Type: Bug
Package: OpenSSL related
Operating System: Linux
PHP Version: 7.1.3
Block user comment: N
Private report: N
New Comment:
Sorry for the foolishness, and thanks all for the help.
Previous Comments:
------------------------------------------------------------------------
[2017-03-29 15:56:53] [email protected]
Your bug title says "openssl_csr_sign" doesn't obey "digest_alg", but you pass "digest_alg" to "openssl_csr_new" instead. It works fine if you pass the option to "openssl_csr_sign".
Unfortunately, the documentation just mentions all options for each and every function, while only some apply to each.
------------------------------------------------------------------------
[2017-03-29 15:53:32] [email protected]
https://security.stackexchange.com/a/67235/41073
tl;dr specifying digest_alg at openssl_csr_new() does not specify what should be used when signing the certificate, rather what should be used when signing the CSR itself.
Props to leigh for finding this.
------------------------------------------------------------------------
[2017-03-29 15:45:28] [email protected]
Thinking about it I'm not sure it actually makes sense to specify the algorithm at the point of creating a new CSR, surely that's up to the signing CA to determine?
When exported, a CSR does not (afaik?) contain this information, so logically it doesn't make sense to specify it here.
If what I said there ^ is correct (it may not be), I think this is a documentation issue more than anything else.
------------------------------------------------------------------------
[2017-03-29 15:37:21] [email protected]
The issue is that openssl_csr_sign() is not using the value defined in the CSR created with openssl_csr_new().
If you pass the ['digest_alg' => 'whatever'] config arg directly to openssl_csr_sign() then it works as expected.
------------------------------------------------------------------------
[2017-03-29 15:29:11] [email protected]
Does openssl_error_string() return anything? Note you should call it multiple times, like
while ($msg = openssl_error_string())
echo $msg . "<br />\n";
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74335
--
Edit this bug report at https://bugs.php.net/bug.php?id=74335&edit=1