Hi Philip,
Thank you for your effort in analyzing this bug and finding work-arounds
or fixes.
We are using a magic script to build all subversion dependencies, e.g.
openssl-1.0.2 and cyrus-sasl-2.1.26. I've used the master branch from
<https://github.com/openssl/openssl> for compiling (~163MB for the
master vs. ~24MB for version 1.0.2) which seems to have compiled fine,
but unfortunately the cyrus-sasl-2.1.26 fails to build. Without actually
understanding what happens there under the hood, I'm a little bit lost.
Should cyrus-sasl also be updated to be compatible with the openssl master?
--
Best regards,
Thomas Singer
=============
syntevo GmbH
http://www.syntevo.com
http://www.syntevo.com/blog
On 2018-02-03 22:40, Philip Martin wrote:
Philip Martin <phi...@codematters.co.uk> writes:
A client using openssl 1.0 will connect to a server serving the
RSASSA-PSS cert. Clients using openssl 1.1 fail to verify cert. The
underlying openssl 1.1 error appears to be
$ openssl s_client -connect localhost:8887 -CAfile apache2/ssl/ca-cert.pem
...
Verify return code: 68 (CA signature digest algorithm too weak)
This suggests that RSASSA-PSS is obsolete, but as I mentioned earlier in
the thread there are recent changes to the openssl project
adding/extending RSASSA-PSS support as part of TLS 1.3:
I built openssl trunk (1.1.1-dev) and it is able to verify the cert:
$ LD_LIBRARY_PATH=/usr/local/openssl/lib /usr/local/openssl/bin/openssl
s_client -connect localhost:8887 -CAfile=apache2/ssl/ca-cert.pem
...
Verify return code: 0 (ok)
This is exactly the same server and cert that cause openssl 1.1 to fail.
