diff options
| author | lloyd <[email protected]> | 2009-11-09 13:22:52 +0000 |
|---|---|---|
| committer | lloyd <[email protected]> | 2009-11-09 13:22:52 +0000 |
| commit | 4049ba134674d78c07c8b0453cb5e5f312469639 (patch) | |
| tree | b9214ede8da1600a46560fe061017fa124b2b465 /doc/examples/gen_certs.cpp | |
| parent | b5d4cf01a893718c8796652f3cf0f68b867bab94 (diff) | |
In creating X.509 certificates and PKCS #10 requests, let (actually: require)
the user to specify the hash function to use, instead of always using SHA-1.
This was a sensible default a few years ago, when there wasn't a ~2^60 attack
on SHA-1 and support for SHA-2 was pretty much nil, but using something else
makes a lot more sense these days.
Diffstat (limited to 'doc/examples/gen_certs.cpp')
| -rw-r--r-- | doc/examples/gen_certs.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/doc/examples/gen_certs.cpp b/doc/examples/gen_certs.cpp index f635e1ccf..90cb80038 100644 --- a/doc/examples/gen_certs.cpp +++ b/doc/examples/gen_certs.cpp @@ -34,7 +34,7 @@ X509_Certificate make_ca_cert(RandomNumberGenerator& rng, opts.end = later; opts.CA_key(); - return X509::create_self_signed_cert(opts, priv_key, rng); + return X509::create_self_signed_cert(opts, priv_key, "SHA-256", rng); } PKCS10_Request make_server_cert_req(const Private_Key& key, @@ -47,7 +47,7 @@ PKCS10_Request make_server_cert_req(const Private_Key& key, opts.add_ex_constraint("PKIX.ServerAuth"); - return X509::create_cert_req(opts, key, rng); + return X509::create_cert_req(opts, key, "SHA-1", rng); } void save_pair(const std::string& name, @@ -92,7 +92,7 @@ int main() save_pair("ca", ca_password, ca_cert, ca_key, rng); - X509_CA ca(ca_cert, ca_key); + X509_CA ca(ca_cert, ca_key, "SHA-256"); RSA_PrivateKey httpd_key(rng, 1536); X509_Certificate httpd_cert = ca.sign_request( |