bin/137841: wpa_supplicant cannot verify SHA256 signed certificates

Wes Morgan morganw at
Sun Aug 16 14:50:13 UTC 2009

>Number:         137841
>Category:       bin
>Synopsis:       wpa_supplicant cannot verify SHA256 signed certificates
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Aug 16 14:50:12 UTC 2009
>Originator:     Wes Morgan
>Release:        8.0-BETA2
FreeBSD catalyst 8.0-BETA2 FreeBSD 8.0-BETA2 #0: Sat Aug  1 07:14:50 CDT 2009     root at catalyst:/usr/obj/usr/src/sys/CATALYST  i386

wpa_supplicant cannot verify a SHA256 signed certificate.
Using XCA or OpenSSL, generate a set of certificates signed with the SHA256 digest. Attempts to use them with wpa_supplicant will fail.
Apply patch from vendor git respository for bug 323.;a=commitdiff;h=e1ffdfc18be9027b5ff9ae254f92b6255930ac71

Patch attached with submission follows:

From: Jouni Malinen <j at>
Date: Sun, 16 Aug 2009 07:25:13 +0000 (+0300)
Subject: Enable SHA256 digest support in OpenSSL

Enable SHA256 digest support in OpenSSL

This is needed to allow X.509 certificates with SHA256 digest to be
used. [Bug 323]

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index d3ff2c5..1a716db 100644
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -735,6 +735,9 @@ void * tls_init(const struct tls_config *conf)
 	if (tls_openssl_ref_count == 0) {
+#ifndef OPENSSL_NO_SHA256
+		EVP_add_digest(EVP_sha256());
+#endif /* OPENSSL_NO_SHA256 */
 		/* TODO: if /dev/urandom is available, PRNG is seeded
 		 * automatically. If this is not the case, random data should
 		 * be added here. */


More information about the freebsd-bugs mailing list