Skip to content

set subject name in I2PControl certificate - #2487

Merged
orignal merged 1 commit into
PurpleI2P:opensslfrom
pobregat0:i2pcontrol-cert-subject
Aug 17, 2026
Merged

set subject name in I2PControl certificate#2487
orignal merged 1 commit into
PurpleI2P:opensslfrom
pobregat0:i2pcontrol-cert-subject

Conversation

@pobregat0

Copy link
Copy Markdown
Contributor

The certificate i2pd makes for I2PControl has an empty subject: the name is
built and then set as the issuer only. OpenSSL 3 does not take it for self
signed, tries to build a chain and refuses the sha1 signature of that "CA":

I2PControl: Failed to load ceritifcate: ca md too weak (SSL routines). Recreating
I2PControl: Can't load certificates
I2PControl: Handshake error: no shared cipher (SSL routines)

so the service never starts at all. A plain self signed sha1 certificate made
by openssl loads on the same machine without a word, so the signature algorithm
is not the cause and is left alone here.

With the subject set the certificate loads and requests are answered, sha1 kept.
A certificate saved by an older version is replaced on start by the code that is
already there. Checked on Debian 13, OpenSSL 3.5.6.

@orignal
orignal merged commit ff5f8d1 into PurpleI2P:openssl Aug 17, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants