URL: https://github.com/SSSD/sssd/pull/837 Title: #837: p11_child: make OCSP digest configurable
karlg100 commented: """ @sumit-bose / @alexey-tikhonov I just updated the RH bugzilla ticket, but I'll post the same here. @alexey-tikhonov - Re you comment https://bugzilla.redhat.com/show_bug.cgi?id=1718478#c2 OCSP responders are NOT guaranteed to accept SHA2 hash types, and depends on the deployment's configuration. We have encountered an issue where an OCSP responder configured for only SHA1 will deny entry to a system when SHA256 is not enabled. Looking thru the RFC, I don't see mention of a responder to be required to answer for all hash types. I'm sure we're not the only ones noticing this change has broken PKI authentication, and it may be prudent for p11_child to attempt a fallback back down to SHA1 if SHA2 OCSP request fails unauthorized. Also, I've not been able to locate the language in FIPS140 that bans SHA1's use. Could you please refer to this in the standards document? """ See the full comment at https://github.com/SSSD/sssd/pull/837#issuecomment-672831519
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
