Skip to content

Commit 32648da

Browse files
jackorpjackorp
committed
Use SHA256 instead of SHA1 where needed in tests.
Systems such as RHEL 9 are moving away from SHA1 disabling it completely in default configuration.
1 parent 1ddbf28 commit 32648da

File tree

8 files changed

+43
-40
lines changed

8 files changed

+43
-40
lines changed

‎test/openssl/test_asn1.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ def test_decode_x509_certificate
1414
["keyUsage","keyCertSign, cRLSign",true],
1515
["subjectKeyIdentifier","hash",false],
1616
]
17-
dgst = OpenSSL::Digest.new('SHA1')
17+
dgst = OpenSSL::Digest.new('SHA256')
1818
cert = OpenSSL::TestUtils.issue_cert(
1919
subj, key, s, exts, nil, nil, digest: dgst, not_before: now, not_after: now+3600)
2020

@@ -42,7 +42,7 @@ def test_decode_x509_certificate
4242
assert_equal(OpenSSL::ASN1::Sequence, sig.class)
4343
assert_equal(2, sig.value.size)
4444
assert_equal(OpenSSL::ASN1::ObjectId, sig.value[0].class)
45-
assert_equal("1.2.840.113549.1.1.5", sig.value[0].oid)
45+
assert_equal("1.2.840.113549.1.1.11", sig.value[0].oid)
4646
assert_equal(OpenSSL::ASN1::Null, sig.value[1].class)
4747

4848
dn = tbs_cert.value[3] # issuer
@@ -189,7 +189,7 @@ def test_decode_x509_certificate
189189
assert_equal(OpenSSL::ASN1::Null, pkey.value[0].value[1].class)
190190

191191
assert_equal(OpenSSL::ASN1::BitString, sig_val.class)
192-
cululated_sig = key.sign(OpenSSL::Digest.new('SHA1'), tbs_cert.to_der)
192+
cululated_sig = key.sign(OpenSSL::Digest.new('SHA256'), tbs_cert.to_der)
193193
assert_equal(cululated_sig, sig_val.value)
194194
end
195195

‎test/openssl/test_ns_spki.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ def test_build_data
2222
spki = OpenSSL::Netscape::SPKI.new
2323
spki.challenge = "RandomString"
2424
spki.public_key = key1.public_key
25-
spki.sign(key1, OpenSSL::Digest.new('SHA1'))
25+
spki.sign(key1, OpenSSL::Digest.new('SHA256'))
2626
assert(spki.verify(spki.public_key))
2727
assert(spki.verify(key1.public_key))
2828
assert(!spki.verify(key2.public_key))

‎test/openssl/test_pkey_dsa.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ def test_sign_verify
5555
assert_equal true, dsa512.verify(OpenSSL::Digest.new('DSS1'), signature, data)
5656
end
5757

58-
signature = dsa512.sign("SHA1", data)
59-
assert_equal true, dsa512.verify("SHA1", signature, data)
58+
signature = dsa512.sign("SHA256", data)
59+
assert_equal true, dsa512.verify("SHA256", signature, data)
6060

6161
signature0 = (<<~'end;').unpack("m")[0]
6262
MCwCFH5h40plgU5Fh0Z4wvEEpz0eE9SnAhRPbkRB8ggsN/vsSEYMXvJwjGg/

‎test/openssl/test_pkey_ec.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,8 @@ def test_check_key
100100
def test_sign_verify
101101
p256 = Fixtures.pkey("p256")
102102
data = "Sign me!"
103-
signature = p256.sign("SHA1", data)
104-
assert_equal true, p256.verify("SHA1", signature, data)
103+
signature = p256.sign("SHA256", data)
104+
assert_equal true, p256.verify("SHA256", signature, data)
105105

106106
signature0 = (<<~'end;').unpack("m")[0]
107107
MEQCIEOTY/hD7eI8a0qlzxkIt8LLZ8uwiaSfVbjX2dPAvN11AiAQdCYx56Fq

‎test/openssl/test_pkey_rsa.rb

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,8 @@ def test_new_break
8080
def test_sign_verify
8181
rsa1024 = Fixtures.pkey("rsa1024")
8282
data = "Sign me!"
83-
signature = rsa1024.sign("SHA1", data)
84-
assert_equal true, rsa1024.verify("SHA1", signature, data)
83+
signature = rsa1024.sign("SHA256", data)
84+
assert_equal true, rsa1024.verify("SHA256", signature, data)
8585

8686
signature0 = (<<~'end;').unpack("m")[0]
8787
oLCgbprPvfhM4pjFQiDTFeWI9Sk+Og7Nh9TmIZ/xSxf2CGXQrptlwo7NQ28+
@@ -118,10 +118,10 @@ def test_sign_verify_options
118118
def test_sign_verify_raw
119119
key = Fixtures.pkey("rsa-1")
120120
data = "Sign me!"
121-
hash = OpenSSL::Digest.digest("SHA1", data)
122-
signature = key.sign_raw("SHA1", hash)
123-
assert_equal true, key.verify_raw("SHA1", signature, hash)
124-
assert_equal true, key.verify("SHA1", signature, data)
121+
hash = OpenSSL::Digest.digest("SHA256", data)
122+
signature = key.sign_raw("SHA256", hash)
123+
assert_equal true, key.verify_raw("SHA256", signature, hash)
124+
assert_equal true, key.verify("SHA256", signature, data)
125125

126126
# Too long data
127127
assert_raise(OpenSSL::PKey::PKeyError) {
@@ -134,9 +134,9 @@ def test_sign_verify_raw
134134
"rsa_pss_saltlen" => 20,
135135
"rsa_mgf1_md" => "SHA256"
136136
}
137-
sig_pss = key.sign_raw("SHA1", hash, pssopts)
138-
assert_equal true, key.verify("SHA1", sig_pss, data, pssopts)
139-
assert_equal true, key.verify_raw("SHA1", sig_pss, hash, pssopts)
137+
sig_pss = key.sign_raw("SHA256", hash, pssopts)
138+
assert_equal true, key.verify("SHA256", sig_pss, data, pssopts)
139+
assert_equal true, key.verify_raw("SHA256", sig_pss, hash, pssopts)
140140
end
141141

142142
def test_sign_verify_raw_legacy

‎test/openssl/test_x509cert.rb

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,14 @@ def test_invalid_extension
173173
end
174174

175175
def test_sign_and_verify_rsa_sha1
176-
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: "sha1")
176+
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: "SHA1")
177177
assert_equal(false, cert.verify(@rsa1024))
178178
assert_equal(true, cert.verify(@rsa2048))
179179
assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
180180
assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) })
181181
cert.serial = 2
182182
assert_equal(false, cert.verify(@rsa2048))
183+
rescue OpenSSL::X509::CertificateError # RHEL 9 disables SHA1
183184
end
184185

185186
def test_sign_and_verify_rsa_md5
@@ -229,6 +230,7 @@ def test_dsa_with_sha2
229230
# SHA1 is allowed from OpenSSL 1.0.0 (0.9.8 requires DSS1)
230231
cert = issue_cert(@ca, @dsa256, 1, [], nil, nil, digest: "sha1")
231232
assert_equal("dsaWithSHA1", cert.signature_algorithm)
233+
rescue OpenSSL::X509::CertificateError # RHEL 9 disables SHA1
232234
end
233235

234236
def test_check_private_key

‎test/openssl/test_x509crl.rb

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ def test_basic
2020

2121
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
2222
crl = issue_crl([], 1, now, now+1600, [],
23-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
23+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
2424
assert_equal(1, crl.version)
2525
assert_equal(cert.issuer.to_der, crl.issuer.to_der)
2626
assert_equal(now, crl.last_update)
@@ -57,7 +57,7 @@ def test_revoked
5757
]
5858
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
5959
crl = issue_crl(revoke_info, 1, Time.now, Time.now+1600, [],
60-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
60+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
6161
revoked = crl.revoked
6262
assert_equal(5, revoked.size)
6363
assert_equal(1, revoked[0].serial)
@@ -98,7 +98,7 @@ def test_revoked
9898

9999
revoke_info = (1..1000).collect{|i| [i, now, 0] }
100100
crl = issue_crl(revoke_info, 1, Time.now, Time.now+1600, [],
101-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
101+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
102102
revoked = crl.revoked
103103
assert_equal(1000, revoked.size)
104104
assert_equal(1, revoked[0].serial)
@@ -124,7 +124,7 @@ def test_extension
124124

125125
cert = issue_cert(@ca, @rsa2048, 1, cert_exts, nil, nil)
126126
crl = issue_crl([], 1, Time.now, Time.now+1600, crl_exts,
127-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
127+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
128128
exts = crl.extensions
129129
assert_equal(3, exts.size)
130130
assert_equal("1", exts[0].value)
@@ -160,32 +160,32 @@ def test_extension
160160
assert_equal(false, exts[2].critical?)
161161

162162
no_ext_crl = issue_crl([], 1, Time.now, Time.now+1600, [],
163-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
163+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
164164
assert_equal nil, no_ext_crl.authority_key_identifier
165165
end
166166

167167
def test_crlnumber
168168
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
169169
crl = issue_crl([], 1, Time.now, Time.now+1600, [],
170-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
170+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
171171
assert_match(1.to_s, crl.extensions[0].value)
172172
assert_match(/X509v3 CRL Number:\s+#{1}/m, crl.to_text)
173173

174174
crl = issue_crl([], 2**32, Time.now, Time.now+1600, [],
175-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
175+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
176176
assert_match((2**32).to_s, crl.extensions[0].value)
177177
assert_match(/X509v3 CRL Number:\s+#{2**32}/m, crl.to_text)
178178

179179
crl = issue_crl([], 2**100, Time.now, Time.now+1600, [],
180-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
180+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
181181
assert_match(/X509v3 CRL Number:\s+#{2**100}/m, crl.to_text)
182182
assert_match((2**100).to_s, crl.extensions[0].value)
183183
end
184184

185185
def test_sign_and_verify
186186
cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
187187
crl = issue_crl([], 1, Time.now, Time.now+1600, [],
188-
cert, @rsa2048, OpenSSL::Digest.new('SHA1'))
188+
cert, @rsa2048, OpenSSL::Digest.new('SHA256'))
189189
assert_equal(false, crl.verify(@rsa1024))
190190
assert_equal(true, crl.verify(@rsa2048))
191191
assert_equal(false, crl_error_returns_false { crl.verify(@dsa256) })
@@ -195,7 +195,7 @@ def test_sign_and_verify
195195

196196
cert = issue_cert(@ca, @dsa512, 1, [], nil, nil)
197197
crl = issue_crl([], 1, Time.now, Time.now+1600, [],
198-
cert, @dsa512, OpenSSL::Digest.new('SHA1'))
198+
cert, @dsa512, OpenSSL::Digest.new('SHA256'))
199199
assert_equal(false, crl_error_returns_false { crl.verify(@rsa1024) })
200200
assert_equal(false, crl_error_returns_false { crl.verify(@rsa2048) })
201201
assert_equal(false, crl.verify(@dsa256))

‎test/openssl/test_x509req.rb

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,31 +23,31 @@ def issue_csr(ver, dn, key, digest)
2323
end
2424

2525
def test_public_key
26-
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
26+
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
2727
assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
2828
req = OpenSSL::X509::Request.new(req.to_der)
2929
assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
3030

31-
req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA1'))
31+
req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA256'))
3232
assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
3333
req = OpenSSL::X509::Request.new(req.to_der)
3434
assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
3535
end
3636

3737
def test_version
38-
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
38+
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
3939
assert_equal(0, req.version)
4040
req = OpenSSL::X509::Request.new(req.to_der)
4141
assert_equal(0, req.version)
4242

43-
req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
43+
req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
4444
assert_equal(1, req.version)
4545
req = OpenSSL::X509::Request.new(req.to_der)
4646
assert_equal(1, req.version)
4747
end
4848

4949
def test_subject
50-
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
50+
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
5151
assert_equal(@dn.to_der, req.subject.to_der)
5252
req = OpenSSL::X509::Request.new(req.to_der)
5353
assert_equal(@dn.to_der, req.subject.to_der)
@@ -78,9 +78,9 @@ def test_attr
7878
OpenSSL::X509::Attribute.new("msExtReq", attrval),
7979
]
8080

81-
req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
81+
req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
8282
attrs.each{|attr| req0.add_attribute(attr) }
83-
req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
83+
req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
8484
req1.attributes = attrs
8585
assert_equal(req0.to_der, req1.to_der)
8686

@@ -108,6 +108,7 @@ def test_sign_and_verify_rsa_sha1
108108
assert_equal(false, request_error_returns_false { req.verify(@dsa512) })
109109
req.version = 1
110110
assert_equal(false, req.verify(@rsa1024))
111+
rescue OpenSSL::X509::RequestError # RHEL 9 disables SHA1
111112
end
112113

113114
def test_sign_and_verify_rsa_md5
@@ -122,7 +123,7 @@ def test_sign_and_verify_rsa_md5
122123
end
123124

124125
def test_sign_and_verify_dsa
125-
req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA1'))
126+
req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest.new('SHA256'))
126127
assert_equal(false, request_error_returns_false { req.verify(@rsa1024) })
127128
assert_equal(false, request_error_returns_false { req.verify(@rsa2048) })
128129
assert_equal(false, req.verify(@dsa256))
@@ -137,14 +138,14 @@ def test_sign_and_verify_dsa_md5
137138
end
138139

139140
def test_dup
140-
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA1'))
141+
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest.new('SHA256'))
141142
assert_equal(req.to_der, req.dup.to_der)
142143
end
143144

144145
def test_eq
145-
req1 = issue_csr(0, @dn, @rsa1024, "sha1")
146-
req2 = issue_csr(0, @dn, @rsa1024, "sha1")
147-
req3 = issue_csr(0, @dn, @rsa1024, "sha256")
146+
req1 = issue_csr(0, @dn, @rsa1024, "sha256")
147+
req2 = issue_csr(0, @dn, @rsa1024, "sha256")
148+
req3 = issue_csr(0, @dn, @rsa1024, "sha512")
148149

149150
assert_equal false, req1 == 12345
150151
assert_equal true, req1 == req2

0 commit comments

Comments
 (0)