bin/137841: wpa_supplicant cannot verify SHA256 signed certificates
Wes Morgan
morganw at chemikals.org
Sun Aug 16 14:50:13 UTC 2009
>Number: 137841
>Category: bin
>Synopsis: wpa_supplicant cannot verify SHA256 signed certificates
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Aug 16 14:50:12 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Wes Morgan
>Release: 8.0-BETA2
>Organization:
>Environment:
FreeBSD catalyst 8.0-BETA2 FreeBSD 8.0-BETA2 #0: Sat Aug 1 07:14:50 CDT 2009 root at catalyst:/usr/obj/usr/src/sys/CATALYST i386
>Description:
wpa_supplicant cannot verify a SHA256 signed certificate.
>How-To-Repeat:
Using XCA or OpenSSL, generate a set of certificates signed with the SHA256 digest. Attempts to use them with wpa_supplicant will fail.
>Fix:
Apply patch from vendor git respository for bug 323.
http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=e1ffdfc18be9027b5ff9ae254f92b6255930ac71
Patch attached with submission follows:
From: Jouni Malinen <j at w1.fi>
Date: Sun, 16 Aug 2009 07:25:13 +0000 (+0300)
Subject: Enable SHA256 digest support in OpenSSL
X-Git-Url: http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=e1ffdfc18be9027b5ff9ae254f92b6255930ac71
Enable SHA256 digest support in OpenSSL
This is needed to allow X.509 certificates with SHA256 digest to be
used. [Bug 323]
---
diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index d3ff2c5..1a716db 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -735,6 +735,9 @@ void * tls_init(const struct tls_config *conf)
if (tls_openssl_ref_count == 0) {
SSL_load_error_strings();
SSL_library_init();
+#ifndef OPENSSL_NO_SHA256
+ EVP_add_digest(EVP_sha256());
+#endif /* OPENSSL_NO_SHA256 */
/* TODO: if /dev/urandom is available, PRNG is seeded
* automatically. If this is not the case, random data should
* be added here. */
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list