[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: x509 AlgorithmIdentifier parameters

From: Philip Martin <philip_at_codematters.co.uk>
Date: Sat, 03 Feb 2018 21:40:48 +0000

Philip Martin <philip_at_codematters.co.uk> writes:

> A client using openssl 1.0 will connect to a server serving the
> RSASSA-PSS cert. Clients using openssl 1.1 fail to verify cert. The
> underlying openssl 1.1 error appears to be
>
> $ openssl s_client -connect localhost:8887 -CAfile apache2/ssl/ca-cert.pem
> ...
> Verify return code: 68 (CA signature digest algorithm too weak)
>
> This suggests that RSASSA-PSS is obsolete, but as I mentioned earlier in
> the thread there are recent changes to the openssl project
> adding/extending RSASSA-PSS support as part of TLS 1.3:

I built openssl trunk (1.1.1-dev) and it is able to verify the cert:

   $ LD_LIBRARY_PATH=/usr/local/openssl/lib /usr/local/openssl/bin/openssl s_client -connect localhost:8887 -CAfile=apache2/ssl/ca-cert.pem
   ...
   Verify return code: 0 (ok)

This is exactly the same server and cert that cause openssl 1.1 to fail.

-- 
Philip
Received on 2018-02-03 22:41:02 CET

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.