Sign self-signed certs with SHA256.

net/cert/x509_util_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_openssl.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/strings/string_piece.h"
 #include "crypto/openssl_util.h"
 #include "crypto/rsa_private_key.h"
 #include "net/cert/x509_cert_types.h"
 
 namespace net {
 
+namespace {
+
+const EVP_MD* HashAlgorithmToEVP(crypto::HMAC::HashAlgorithm alg) {
+  switch (alg) {
+    case crypto::HMAC::SHA1:
+      return EVP_sha1();
+    case crypto::HMAC::SHA256:
+      return EVP_sha256();
+  }
+  return NULL;
+}
+
+}  // namespace
+
 namespace x509_util {
 
 bool IsSupportedValidityRange(base::Time not_valid_before,
                               base::Time not_valid_after) {
   if (not_valid_before > not_valid_after)
     return false;
 
   // The validity field of a certificate can only encode years 1-9999.
 
   // Compute the base::Time values corresponding to Jan 1st,0001 and
@@ skipping 15 matching lines @@
   const base::Time kYear10000 = kEpoch +
       base::TimeDelta::FromDays(kDaysFromUnixEpochToYear10000);
 
   if (not_valid_before < kYear0001 || not_valid_before >= kYear10000 ||
       not_valid_after < kYear0001 || not_valid_after >= kYear10000)
     return false;
 
   return true;
 }
 
-bool CreateDomainBoundCertEC(
+bool CreateDomainBoundCertECInternal(
     crypto::ECPrivateKey* key,
+    crypto::HMAC::HashAlgorithm alg,
     const std::string& domain,
     uint32 serial_number,
     base::Time not_valid_before,
     base::Time not_valid_after,
     std::string* der_cert) {
   NOTIMPLEMENTED();
   return false;
 }
 
-bool CreateSelfSignedCert(crypto::RSAPrivateKey* key,
-                          const std::string& common_name,
-                          uint32 serial_number,
-                          base::Time not_valid_before,
-                          base::Time not_valid_after,
-                          std::string* der_encoded) {
+bool CreateSelfSignedCertInternal(crypto::RSAPrivateKey* key,
+                                  crypto::HMAC::HashAlgorithm alg,
+                                  const std::string& common_name,
+                                  uint32 serial_number,
+                                  base::Time not_valid_before,
+                                  base::Time not_valid_after,
+                                  std::string* der_encoded) {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
   static const char kCommonNamePrefix[] = "CN=";
   const size_t kCommonNamePrefixLen = sizeof(kCommonNamePrefix) - 1;
 
   // Put the serial number into an OpenSSL-friendly object.
   crypto::ScopedOpenSSL<ASN1_INTEGER, ASN1_INTEGER_free> asn1_serial(
       ASN1_INTEGER_new());
   if (!asn1_serial.get() ||
       !ASN1_INTEGER_set(asn1_serial.get(), static_cast<long>(serial_number))) {
     LOG(ERROR) << "Invalid serial number " << serial_number;
@@ skipping 52 matching lines @@
       !X509_set_pubkey(cert.get(), key->key()) ||
       !X509_set_serialNumber(cert.get(), asn1_serial.get()) ||
       !X509_set_notBefore(cert.get(), asn1_not_before_time.get()) ||
       !X509_set_notAfter(cert.get(), asn1_not_after_time.get()) ||
       !X509_set_subject_name(cert.get(), name.get()) ||
       !X509_set_issuer_name(cert.get(), name.get())) {
     LOG(ERROR) << "Could not create certificate";
     return false;
   }
 
+  // Get the message digest algorithm
+  const EVP_MD* md = HashAlgorithmToEVP(alg);
+  if (!md) {
+    LOG(ERROR) << "Unrecognized hash algorithm.";
+    return false;
+  }
+
   // Sign it with the private key.
-  if (!X509_sign(cert.get(), key->key(), EVP_sha1())) {
+  if (!X509_sign(cert.get(), key->key(), md)) {
     LOG(ERROR) << "Could not sign certificate with key.";
     return false;
   }
 
   // Convert it into a DER-encoded string copied to |der_encoded|.
   int der_data_length = i2d_X509(cert.get(), NULL);
   if (der_data_length < 0)
     return false;
 
   der_encoded->resize(static_cast<size_t>(der_data_length));
@@ skipping 57 matching lines @@
                              x509_time->length);
 
   CertDateFormat format = x509_time->type == V_ASN1_UTCTIME ?
       CERT_DATE_FORMAT_UTC_TIME : CERT_DATE_FORMAT_GENERALIZED_TIME;
   return ParseCertificateDate(str_date, format, time);
 }
 
 }  // namespace x509_util
 
 }  // namespace net