made signature algorithm configurable

diff --git a/cam/ca.py b/cam/ca.py
index 0bf7fcf..f870389 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -28,7 +28,7 @@ class CA(object):
         self.basedir = basedir
         self.config = {'basedir': basedir, 'default_days': '365', 'ou': 'CA',
                        'days': '3650', 'country': 'XX', 'crl_url': '',
-                       'bits': '4096'}
+                       'signature_algorithm': 'sha1', 'bits': '2048'}
         self.config.update(config)
         self.files = _CAFiles(basedir, 
                               conf='conf/ca.conf',
@@ -113,6 +113,7 @@ class CA(object):
                 self.basedir, self.files.conf,
                 'ca', '-keyfile', self.files.private_key,
                 '-key', self._getpw(),
+                '-md', self.config['signature_algorithm'],
                 '-extensions', 'v3_ca', '-out', self.files.public_key,
                 '-days', self.config.get('days', self.config['default_days']),
                 '-selfsign', '-infiles', csr_file)
@@ -192,6 +193,7 @@ class CA(object):
                 self.basedir, conf_file,
                 'ca', '-days', conf['days'],
                 '-key', self._getpw(),
+                '-md', self.config['signature_algorithm'],
                 '-policy', 'policy_anything', '-out', cert.public_key_file,
                 '-extfile', ext_file, '-infiles', csr_file)
         finally:

diff --git a/cam/tests/test_ca.py b/cam/tests/test_ca.py
index 35c61a3..748326f 100644 (file)
--- a/cam/tests/test_ca.py
+++ b/cam/tests/test_ca.py
@@ -2,6 +2,7 @@ import logging
 import os
 import tempfile
 import shutil
+import subprocess
 import unittest
 from cam import ca
 from cam import openssl_wrap
@@ -24,6 +25,9 @@ class CertStub(object):
     def get_expiration_date(self):
         return 123456789
 
+    def exists(self):
+        return os.path.exists(self.public_key_file)
+
 
 class CATest(unittest.TestCase):
 
@@ -49,6 +53,17 @@ class CATest(unittest.TestCase):
         self.assertTrue(os.path.exists(cert.public_key_file))
         self.assertTrue(os.path.exists(cert.private_key_file))
 
+    def test_create_cert_with_sha2_signature(self):
+        self.ca.config['signature_algorithm'] = 'sha256'
+        self.ca.create()
+        cert = CertStub('test', 'www.test.com', self.tmpdir)
+        self.ca.generate(cert)
+        self.assertTrue(os.path.exists(cert.public_key_file))
+        self.assertTrue(os.path.exists(cert.private_key_file))
+        self.assertTrue(
+            'Signature Algorithm: sha256WithRSAEncryption' in subprocess.check_output(
+            ['openssl', 'x509', '-text', '-noout', '-in', cert.public_key_file]))
+
     def test_revoke(self):
         self.ca.create()
         cert = CertStub('test', 'www.test.com', self.tmpdir)