Merge "winrmlistener: use sha2 instead of insecure sha1"

cloudbase · Mar 27, 2024 · 4bb6895 · 4bb6895
2 parents 2b1770d + a373d55
commit 4bb6895
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/cloudbaseinit/utils/windows/cryptoapi.py b/cloudbaseinit/utils/windows/cryptoapi.py
@@ -137,8 +137,10 @@ class CERT_KEY_CONTEXT(ctypes.Structure):
 CERT_KEY_PROV_INFO_PROP_ID = 2
 CERT_KEY_CONTEXT_PROP_ID = 5
 
+# https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-crypt_algorithm_identifier
 szOID_PKIX_KP_SERVER_AUTH = b"1.3.6.1.5.5.7.3.1"
 szOID_RSA_SHA1RSA = b"1.2.840.113549.1.1.5"
+szOID_RSA_SHA256RSA = b"1.2.840.113549.1.1.11"
 
 advapi32 = windll.advapi32
 crypt32 = windll.crypt32

diff --git a/cloudbaseinit/utils/windows/x509.py b/cloudbaseinit/utils/windows/x509.py
@@ -195,7 +195,7 @@ def create_self_signed_cert(self, subject, validity_years=10,
                 key_prov_info.dwFlags = 0
 
             sign_alg = cryptoapi.CRYPT_ALGORITHM_IDENTIFIER()
-            sign_alg.pszObjId = cryptoapi.szOID_RSA_SHA1RSA
+            sign_alg.pszObjId = cryptoapi.szOID_RSA_SHA256RSA
 
             start_time = cryptoapi.SYSTEMTIME()
             cryptoapi.GetSystemTime(ctypes.byref(start_time))