In creating X.509 certificates and PKCS #10 requests, let (actually: require)

the user to specify the hash function to use, instead of always using SHA-1.
This was a sensible default a few years ago, when there wasn't a ~2^60 attack
on SHA-1 and support for SHA-2 was pretty much nil, but using something else
makes a lot more sense these days.

1 files changed, 1 insertions, 1 deletions

diff --git a/doc/examples/ca.cpp b/doc/examples/ca.cpp
index 41dd409d5..9195be418 100644
--- a/doc/examples/ca.cpp
+++ b/doc/examples/ca.cpp
@@ -47,7 +47,7 @@ int main(int argc, char* argv[])
          PKCS8::load_key(arg_ca_key, rng, arg_passphrase)
          );
 
-      X509_CA ca(ca_cert, *privkey);
+      X509_CA ca(ca_cert, *privkey, "SHA-256");
 
       // got a request
       PKCS10_Request req(arg_req_file);