Bug #74335 [Com]: digest_alg configarg for openssl_csr_sign has no effect

Edit report at https://bugs.php.net/bug.php?id=74335&edit=1 ID: 74335 Comment by: kelunik@php.net Reported by: jmaguire at duo dot com Summary: digest_alg configarg for openssl_csr_sign has no effect Status: Feedback Type: Bug Package: OpenSSL related Operating System: Linux PHP Version: 7.1.3 Block user comment: N Private report: N New Comment: Your bug title says "openssl_csr_sign" doesn't obey "digest_alg", but you pass "digest_alg" to "openssl_csr_new" instead. It works fine if you pass the option to "openssl_csr_sign". Unfortunately, the documentation just mentions all options for each and every function, while only some apply to each. Previous Comments: ------------------------------------------------------------------------ [2017-03-29 15:53:32] daverandom@php.net https://security.stackexchange.com/a/67235/41073 tl;dr specifying digest_alg at openssl_csr_new() does not specify what should be used when signing the certificate, rather what should be used when signing the CSR itself. Props to leigh for finding this. ------------------------------------------------------------------------ [2017-03-29 15:45:28] daverandom@php.net Thinking about it I'm not sure it actually makes sense to specify the algorithm at the point of creating a new CSR, surely that's up to the signing CA to determine? When exported, a CSR does not (afaik?) contain this information, so logically it doesn't make sense to specify it here. If what I said there ^ is correct (it may not be), I think this is a documentation issue more than anything else. ------------------------------------------------------------------------ [2017-03-29 15:37:21] daverandom@php.net The issue is that openssl_csr_sign() is not using the value defined in the CSR created with openssl_csr_new(). If you pass the ['digest_alg' => 'whatever'] config arg directly to openssl_csr_sign() then it works as expected. ------------------------------------------------------------------------ [2017-03-29 15:29:11] requinix@php.net Does openssl_error_string() return anything? Note you should call it multiple times, like while ($msg = openssl_error_string()) echo $msg . "<br />\n"; ------------------------------------------------------------------------ [2017-03-29 15:10:15] jmaguire at duo dot com PHP 5.6.17-3 (cli) exhibits the same behavior. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=74335 -- Edit this bug report at https://bugs.php.net/bug.php?id=74335&edit=1