On Wed, Oct 21, 2026 at 7:26 AM Dimitris Soumis <[email protected]> wrote:
> Running the test suite against OpenSSL 3.5.9 (on Fedora), TestCrlSupport
> has
> 6 failures.
>
> According to AI (I haven't investigated further):
>
> "The CRL fixtures
> test/org/apache/tomcat/util/net/{empty,populated}-crl.pem are signed with
> sha1WithRSAEncryption. OpenSSL 3.5 (and Fedora's crypto policy) refuse to
> verify
> a SHA-1 signature, so the CRL check fails with 'CRL signature failure' and
> the
> server rejects otherwise-valid client certificates. The CA certificate
> itself is
> SHA-256; only the CRLs are SHA-1. JSSE trust passes because it is lenient
> about
> the CRL signature."
>
> keytool -exportcert -rfc -keystore user1.jks -storepass changeit -alias
> user1 > user1.pem
> openssl verify -crl_check -CAfile ca-cert.pem -CRLfile populated-crl.pem
> user1.pem
> => error 8 ... CRL signature failure (do_sigver_init: invalid digest)
> OPENSSL_ENABLE_SHA1_SIGNATURES=1 openssl verify -crl_check \
> -CAfile ca-cert.pem -CRLfile populated-crl.pem user1.pem
> => user1.pem: OK
>
> I think that the CRLs should be regenerated with SHA-256.
>
+1 to regenerate. I ran into the issue last month (see
https://lists.apache.org/thread.html/r3s5mc6roy8m2ncjwoy4dptbnrvxpl50), but
it didn't seem to be bothering anyone else so I didn't make time to try
fixing it.
>
> Kind regards,
> Dimitris
>
