Details related to "CA signature digest algorithm too weak"

vlrk · 02-29-2024, 02:15 AM

Hi all, having query related to error log "CA signature digest algorithm too weak" ..

this is shown after I migrated from openssl 1.1.1u to openssl 3.1.1

the same goes off .. when I set SSL_CTX_set_cipher_list(ctx,"ALL:eNULL:@SECLEVEL=0");

any idea related to this.

jayjwa · 02-29-2024, 12:42 PM

Look at the CA cert in question. Specifically, the line Signature Algorithm. Awhile back, I updated Openssl and it broke my CA as sha1 was no longer allowed. None of the certs would work with things linked against the new SSL. Check the CA cert with

Code:

openssl x509 -in ca-crt.pem -noout -text

...

            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Key Usage: 
                Certificate Sign, CRL Sign
            Netscape Cert Type: 
                SSL CA, S/MIME CA
    Signature Algorithm: sha256WithRSAEncryption

sha256 is fine. For now. If that's not it then I'm not sure.

vlrk · 03-05-2024, 08:06 PM

Thanks @jayjwa,

Team,

Need help in understanding below .

What exact difference between SSL_CTX_set_cipher_list(ctx, "HIGH:SHA1:@SECLEVEL=0") which is being used with openssl-3.1.1 and just keeping the SSL_CTX_set_cipher_list(ctx, "ALL") (this setting being used in openssl-1.1.1u) .

I am moving from openss-1.1.1u to openssl-3.1.1. So not sure , with this AM I decreasing the security level overall to support SHA1 compared to 1.1.1u version .

Please share your thoughts

Regards