Skip to content

sign I2PControl certificate with sha256 - #2484

Closed
pobregat0 wants to merge 1 commit into
PurpleI2P:opensslfrom
pobregat0:i2pcontrol-cert-sha256
Closed

sign I2PControl certificate with sha256#2484
pobregat0 wants to merge 1 commit into
PurpleI2P:opensslfrom
pobregat0:i2pcontrol-cert-sha256

Conversation

@pobregat0

Copy link
Copy Markdown
Contributor

On OpenSSL 3 the self signed certificate is signed with sha1, which is refused
at the default security level, so I2PControl never gets a working SSL context:

I2PControl: Failed to load ceritifcate: ca md too weak (SSL routines). Recreating
I2PControl: Can't load certificates
I2PControl: Handshake error: no shared cipher (SSL routines)

With sha256 the service starts and answers requests. Checked on Debian 13,
OpenSSL 3.5.6, and on a second machine with the same version.

@wipedlifepotato

wipedlifepotato commented Aug 17, 2026

Copy link
Copy Markdown
Contributor
	X509_sign (x509, pkey, EVP_sha256 ()); // sha1 is rejected as too weak since OpenSSL 3

袗 褝褌芯, 芯薪芯 胁 java sha1?

袗 芯薪芯 谢芯泻邪谢褜薪芯械

Comment thread daemon/I2PControl.cpp
X509_NAME_add_entry_by_txt (name, "CN", MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_COMMON_NAME, -1, -1, 0); // common name
X509_set_issuer_name (x509, name); // set issuer to ourselves
X509_sign (x509, pkey, EVP_sha1 ()); // sign, last param must be NULL for EdDSA
X509_sign (x509, pkey, EVP_sha256 ()); // sha1 is rejected as too weak since OpenSSL 3

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

薪芯褉屑

@wipedlifepotato

Copy link
Copy Markdown
Contributor

泻泻

@orignal

orignal commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

It might be an issue with apps like itoopie

@pobregat0

Copy link
Copy Markdown
Contributor Author

Wrong fix: the digest is not the cause. The certificate has an empty subject, so OpenSSL 3 does not take it for self signed and refuses it as a weak CA. A self signed sha1 certificate loads fine on the same machine. Replaced by #2487, which sets the subject and leaves sha1 alone.

@pobregat0 pobregat0 closed this Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants