SHA 256

[Cantor, Scott]

On 11/5/15, 4:33 PM, "users on behalf of csross" <users-bounces at shibboleth.net on behalf of cross at hccs.com> wrote:



>I asked this because it is in the keygen.sh file, which was in the
>shibboleth SP install.  How could www.openssl.org know about that?

It's a shell script that runs openssl. If you want to understand the OpenSSL configuration settings it's using or change them, you would need to look at their documentation and reverse engineer the script.

Changing your key is a horrendous idea, and that's what that script does, it generates new keys. If you insist on using a SHA-2 certificate, you're going to want to produce a new self-signed certificate based on the existing keypair, or you're going to break *every* interaction you have now that depends on use of that key for signing or encryption.

You probably don't need to do any of that. The algorithm used in a certificate that isn't used for anything but transporting a public key doesn't matter. You should simply stop and do nothing here. There's really nothing to do in most cases.

>With regards to this question.  Thank you.  There was a shib doc that
>indicated that older openssl didn't support sha2 which is why ADFS had to
>specify SHA1?  Is that correct and what affects this?

That's talking about the XML Signature digest and signature algorithms used in SAML, and it's referring to the fact that ADFS SPs will refuse to accept traffic from a Shibboleth V2 IdP since that IdP version uses SHA-1 and isn't that easy to change the behavior of.

-- Scott