Sign self-signed certs with SHA256.

net/cert/x509_util_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_nss.h"
 
 #include <cert.h>  // Must be included before certdb.h
 #include <certdb.h>
 #include <cryptohi.h>
@@ skipping 116 matching lines @@
   }
 
   // Cleanup for resources used to generate the cert.
   CERT_DestroyName(subject_name);
   CERT_DestroyValidity(validity);
   CERT_DestroyCertificateRequest(cert_request);
 
   return cert;
 }
 
+SECOidTag HashAlgorithmToIdTag(crypto::HMAC::HashAlgorithm alg) {

[Ryan Sleevi, 2013/10/18 22:45:23]

ToSECOid

[bemasc, 2013/10/19 00:47:45]

Done.

+  SECOidTag id_tag = SEC_OID_UNKNOWN;
+  switch (alg) {
+    case crypto::HMAC::SHA1:
+      id_tag = SEC_OID_SHA1;
+      break;
+    case crypto::HMAC::SHA256:
+      id_tag = SEC_OID_SHA256;
+      break;
+  }
+  return id_tag;
+}
+
 // Signs a certificate object, with |key| generating a new X509Certificate
 // and destroying the passed certificate object (even when NULL is returned).
 // The logic of this method references SignCert() in NSS utility certutil:
 // http://mxr.mozilla.org/security/ident?i=SignCert.
 // Returns true on success or false if an error is encountered in the
 // certificate signing process.
 bool SignCertificate(
     CERTCertificate* cert,
-    SECKEYPrivateKey* key) {
+    SECKEYPrivateKey* key,
+    SECOidTag alg_id_tag) {

[Ryan Sleevi, 2013/10/18 22:45:23]

s/alg_id_tag/hash_algorithm/

[bemasc, 2013/10/19 00:47:45]

Done.

   // |arena| is used to encode the cert.
   PLArenaPool* arena = cert->arena;
-  SECOidTag algo_id = SEC_GetSignatureAlgorithmOidTag(key->keyType,
-                                                      SEC_OID_SHA1);
+  SECOidTag algo_id = SEC_GetSignatureAlgorithmOidTag(key->keyType, alg_id_tag);
   if (algo_id == SEC_OID_UNKNOWN)
     return false;
 
   SECStatus rv = SECOID_SetAlgorithmID(arena, &cert->signature, algo_id, 0);
   if (rv != SECSuccess)
     return false;
 
   // Generate a cert of version 3.
   *(cert->version.data) = 2;
   cert->version.len = 1;
@@ skipping 72 matching lines @@
 
   return name.release();
 }
 
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 }  // namespace
 
 namespace x509_util {
 
-bool CreateSelfSignedCert(crypto::RSAPrivateKey* key,
-                          const std::string& subject,
-                          uint32 serial_number,
-                          base::Time not_valid_before,
-                          base::Time not_valid_after,
-                          std::string* der_cert) {
+bool CreateSelfSignedCertInternal(crypto::RSAPrivateKey* key,
+                                  crypto::HMAC::HashAlgorithm alg,
+                                  const std::string& subject,
+                                  uint32 serial_number,
+                                  base::Time not_valid_before,
+                                  base::Time not_valid_after,
+                                  std::string* der_cert) {
   DCHECK(key);
   DCHECK(!strncmp(subject.c_str(), "CN=", 3U));
   CERTCertificate* cert = CreateCertificate(key->public_key(),
                                             subject,
                                             serial_number,
                                             not_valid_before,
                                             not_valid_after);
   if (!cert)
     return false;
 
-  if (!SignCertificate(cert, key->key())) {
+  if (!SignCertificate(cert, key->key(), HashAlgorithmToIdTag(alg))) {
     CERT_DestroyCertificate(cert);
     return false;
   }
 
   der_cert->assign(reinterpret_cast<char*>(cert->derCert.data),
                    cert->derCert.len);
   CERT_DestroyCertificate(cert);
   return true;
 }
 
 bool IsSupportedValidityRange(base::Time not_valid_before,
                               base::Time not_valid_after) {
   CERTValidity* validity = CERT_CreateValidity(
       crypto::BaseTimeToPRTime(not_valid_before),
       crypto::BaseTimeToPRTime(not_valid_after));
 
   if (!validity)
     return false;
 
   CERT_DestroyValidity(validity);
   return true;
 }
 
-bool CreateDomainBoundCertEC(crypto::ECPrivateKey* key,
-                             const std::string& domain,
-                             uint32 serial_number,
-                             base::Time not_valid_before,
-                             base::Time not_valid_after,
-                             std::string* der_cert) {
+bool CreateDomainBoundCertECInternal(crypto::ECPrivateKey* key,
+                                     crypto::HMAC::HashAlgorithm alg,
+                                     const std::string& domain,
+                                     uint32 serial_number,
+                                     base::Time not_valid_before,
+                                     base::Time not_valid_after,
+                                     std::string* der_cert) {
   DCHECK(key);
 
   CERTCertificate* cert = CreateCertificate(key->public_key(),
                                             "CN=anonymous.invalid",
                                             serial_number,
                                             not_valid_before,
                                             not_valid_after);
 
   if (!cert)
     return false;
@@ skipping 36 matching lines @@
     return false;
   }
 
   // Copy extension into x509 cert
   if (CERT_FinishExtensions(cert_handle) != SECSuccess){
     LOG(ERROR) << "Unable to copy extension to X509 cert";
     CERT_DestroyCertificate(cert);
     return false;
   }
 
-  if (!SignCertificate(cert, key->key())) {
+  if (!SignCertificate(cert, key->key(), HashAlgorithmToIdTag(alg))) {
     CERT_DestroyCertificate(cert);
     return false;
   }
 
   DCHECK(cert->derCert.len);
   // XXX copied from X509Certificate::GetDEREncoded
   der_cert->clear();
   der_cert->append(reinterpret_cast<char*>(cert->derCert.data),
                    cert->derCert.len);
   CERT_DestroyCertificate(cert);
@@ skipping 261 matching lines @@
   }
 
   return new_name;
 }
 
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 } // namespace x509_util
 
 } // namespace net