xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-01-11 10:32:31 +00:00
Code Issues Projects Releases Wiki Activity

Use sha284 hash algorithm

Browse Source 
Some implementations reject sha256 as inadequate if ecdsa has 384 bit keylength. Bring the digest up to match
the key size for the ECDSA.
This commit is contained in:
Jarrod Johnson
2025-10-27 06:41:05 -04:00
parent 6c9c58f464
commit 24a76612ae
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
confluent_server/confluent/certutil.py
View File

@@ -242,7 +242,7 @@ def create_full_ca(certout):
subprocess.check_call(
['openssl', 'ca', '-config', newcfg, '-batch', '-selfsign',
'-extensions', 'CACert', '-extfile', newcfg,
'-notext', '-startdate',
'-notext', '-startdate', '-md', 'sha384',
'19700101010101Z', '-enddate', '21000101010101Z', '-keyfile',
keyout, '-out', '/etc/confluent/tls/ca/cacert.pem', '-in', csrout]
)
@@ -378,7 +378,7 @@ def create_certificate(keyout=None, certout=None, csrfile=None, subj=None, san=N
subprocess.check_call([
'openssl', 'ca', '-config', cacfgfile, '-rand_serial',
'-in', csrfile, '-out', certout, '-batch', '-notext',
'-startdate', startdate, '-enddate', enddate,
'-startdate', startdate, '-enddate', enddate, '-md', 'sha384',
'-extfile', extconfig, '-subj', subj
])
for keycopy in tlsmateriallocation.get('keys', []):