Sign self-signed certs with SHA256.

net/cert/x509_util_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_nss.h"
 
 #include <cert.h>  // Must be included before certdb.h
 #include <certdb.h>
 #include <cryptohi.h>
@@ skipping 116 matching lines @@
   }
 
   // Cleanup for resources used to generate the cert.
   CERT_DestroyName(subject_name);
   CERT_DestroyValidity(validity);
   CERT_DestroyCertificateRequest(cert_request);
 
   return cert;
 }
 
+SECOidTag ToSECOid(x509_util::DigestAlgorithm alg) {
+  switch (alg) {
+    case x509_util::DIGEST_SHA1:
+      return SEC_OID_SHA1;
+    case x509_util::DIGEST_SHA256:
+      return SEC_OID_SHA256;
+  }
+  return SEC_OID_UNKNOWN;
+}
+
 // Signs a certificate object, with |key| generating a new X509Certificate
 // and destroying the passed certificate object (even when NULL is returned).
 // The logic of this method references SignCert() in NSS utility certutil:
 // http://mxr.mozilla.org/security/ident?i=SignCert.
 // Returns true on success or false if an error is encountered in the
 // certificate signing process.
 bool SignCertificate(
     CERTCertificate* cert,
-    SECKEYPrivateKey* key) {
+    SECKEYPrivateKey* key,
+    SECOidTag hash_algorithm) {
   // |arena| is used to encode the cert.
   PLArenaPool* arena = cert->arena;
   SECOidTag algo_id = SEC_GetSignatureAlgorithmOidTag(key->keyType,
-                                                      SEC_OID_SHA1);
+                                                      hash_algorithm);
   if (algo_id == SEC_OID_UNKNOWN)
     return false;
 
   SECStatus rv = SECOID_SetAlgorithmID(arena, &cert->signature, algo_id, 0);
   if (rv != SECSuccess)
     return false;
 
   // Generate a cert of version 3.
   *(cert->version.data) = 2;
   cert->version.len = 1;
@@ skipping 73 matching lines @@
   return name.release();
 }
 
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 }  // namespace
 
 namespace x509_util {
 
 bool CreateSelfSignedCert(crypto::RSAPrivateKey* key,
+                          DigestAlgorithm alg,
                           const std::string& subject,
                           uint32 serial_number,
                           base::Time not_valid_before,
                           base::Time not_valid_after,
                           std::string* der_cert) {
   DCHECK(key);
   DCHECK(!strncmp(subject.c_str(), "CN=", 3U));
   CERTCertificate* cert = CreateCertificate(key->public_key(),
                                             subject,
                                             serial_number,
                                             not_valid_before,
                                             not_valid_after);
   if (!cert)
     return false;
 
-  if (!SignCertificate(cert, key->key())) {
+  if (!SignCertificate(cert, key->key(), ToSECOid(alg))) {
     CERT_DestroyCertificate(cert);
     return false;
   }
 
   der_cert->assign(reinterpret_cast<char*>(cert->derCert.data),
                    cert->derCert.len);
   CERT_DestroyCertificate(cert);
   return true;
 }
 
 bool IsSupportedValidityRange(base::Time not_valid_before,
                               base::Time not_valid_after) {
   CERTValidity* validity = CERT_CreateValidity(
       crypto::BaseTimeToPRTime(not_valid_before),
       crypto::BaseTimeToPRTime(not_valid_after));
 
   if (!validity)
     return false;
 
   CERT_DestroyValidity(validity);
   return true;
 }
 
 bool CreateDomainBoundCertEC(crypto::ECPrivateKey* key,
+                             DigestAlgorithm alg,
                              const std::string& domain,
                              uint32 serial_number,
                              base::Time not_valid_before,
                              base::Time not_valid_after,
                              std::string* der_cert) {
   DCHECK(key);
 
   CERTCertificate* cert = CreateCertificate(key->public_key(),
                                             "CN=anonymous.invalid",
                                             serial_number,
@@ skipping 41 matching lines @@
     return false;
   }
 
   // Copy extension into x509 cert
   if (CERT_FinishExtensions(cert_handle) != SECSuccess){
     LOG(ERROR) << "Unable to copy extension to X509 cert";
     CERT_DestroyCertificate(cert);
     return false;
   }
 
-  if (!SignCertificate(cert, key->key())) {
+  if (!SignCertificate(cert, key->key(), ToSECOid(alg))) {
     CERT_DestroyCertificate(cert);
     return false;
   }
 
   DCHECK(cert->derCert.len);
   // XXX copied from X509Certificate::GetDEREncoded
   der_cert->clear();
   der_cert->append(reinterpret_cast<char*>(cert->derCert.data),
                    cert->derCert.len);
   CERT_DestroyCertificate(cert);
@@ skipping 261 matching lines @@
   }
 
   return new_name;
 }
 
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 } // namespace x509_util
 
 } // namespace net