Difuse/telephony
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

freeswitch-stable: fix weak md in gentls_cert

Browse source 
gentls_cert generates certificates that are deemed too weak by Debian's
OpenSSL (on Buster and up). This patch upgrades the message digest to
SHA256 to address this.

See patch for details. Sent upstream ([1]).

[1] https://github.com/signalwire/freeswitch/pull/126

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This commit is contained in:
Sebastian Kemper 2019-12-20 09:32:20 +01:00
parent c524d5a712
commit 7d8fc4b6e6
1 changed files with 51 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
net/freeswitch-stable/patches/040-gentls_cert_update_message_digest.patch Normal file
View file

@ -0,0 +1,51 @@
commit 70d1cbafe4ab0176cd9fc01f740e34cd1bae326b
Author: Sebastian Kemper <sebastian_ml@gmx.net>
Date: Wed Nov 13 20:29:50 2019 +0100
[gentls_cert] Update message digest
Debian Buster updated /etc/ssl/openssl.cnf to default to
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2
gentls_cert currently uses SHA1 as message digest. According to OpenSSL
documentation this only offers 80 bit of security. 80 bits is enough for
security level 1, but not 2.
The OpenSSL default MD nowadays is SHA256. This commit updates
gentls_cert to use it.
Issue was reported on the FS mailing list. The certificates created by
gentls_cert caused "md too weak" errors and clients were unable to
connect.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
diff --git a/scripts/gentls_cert.in b/scripts/gentls_cert.in
index 43aa8ac605..dd56c9f6dc 100644
--- a/scripts/gentls_cert.in
+++ b/scripts/gentls_cert.in
@@ -89,7 +89,7 @@ setup_ca() {
openssl req -out "${CONFDIR}/CA/cacert.pem" \
-new -x509 -keyout "${CONFDIR}/CA/cakey.pem" \
- -config "${TMPFILE}.cfg" -nodes -days ${DAYS} -sha1 >/dev/null || exit 1
+ -config "${TMPFILE}.cfg" -nodes -days ${DAYS} -sha256 >/dev/null || exit 1
cat "${CONFDIR}/CA/cacert.pem" > "${CONFDIR}/cafile.pem"
cp $TMPFILE.cfg /tmp/ssl.cfg
rm "${TMPFILE}.cfg"
@@ -131,11 +131,11 @@ generate_cert() {
openssl req -new -out "${TMPFILE}.req" \
-newkey rsa:${KEY_SIZE} -keyout "${TMPFILE}.key" \
- -config "${TMPFILE}.cfg" -nodes -sha1 >/dev/null || exit 1
+ -config "${TMPFILE}.cfg" -nodes -sha256 >/dev/null || exit 1
openssl x509 -req -CAkey "${CONFDIR}/CA/cakey.pem" -CA "${CONFDIR}/CA/cacert.pem" -CAcreateserial \
-in "${TMPFILE}.req" -out "${TMPFILE}.crt" -extfile "${TMPFILE}.cfg" \
- -extensions "${EXTENSIONS}" -days ${DAYS} -sha1 >/dev/null || exit 1
+ -extensions "${EXTENSIONS}" -days ${DAYS} -sha256 >/dev/null || exit 1
cat "${TMPFILE}.crt" "${TMPFILE}.key" > "${CONFDIR}/${OUTFILE}"