switch the digest default to SHA2

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index f870389..043cc7e 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -28,7 +28,7 @@ class CA(object):
         self.basedir = basedir
         self.config = {'basedir': basedir, 'default_days': '365', 'ou': 'CA',
                        'days': '3650', 'country': 'XX', 'crl_url': '',
-                       'signature_algorithm': 'sha1', 'bits': '2048'}
+                       'signature_algorithm': 'sha256', 'bits': '2048'}
         self.config.update(config)
         self.files = _CAFiles(basedir, 
                               conf='conf/ca.conf',
@@ -187,6 +187,7 @@ class CA(object):
             openssl_wrap.run_with_config(
                 self.basedir, conf_file,
                 'req', '-new', '-keyout', cert.private_key_file,
+                '-' + self.config['signature_algorithm'],
                 '-nodes', '-out', csr_file)
             os.chmod(cert.private_key_file, 0600)
             openssl_wrap.run_with_config(