diff options
| author | gartens <41197811+gartens@users.noreply.github.com> | 2024-06-11 19:12:23 +0200 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2024-06-11 17:12:28 +0000 |
| commit | c735f4947ee0fd770f01a64e83faabefe005e9d4 (patch) | |
| tree | a5876468d10939a1cbf31480ca26e837102de1f8 /ext | |
| parent | 39019b6a63b935d8bd75e46ff82a31e174b1bf85 (diff) | |
[ruby/openssl] Pass through nil as digest when signing certificates
(https://github.com/ruby/openssl/pull/761)
In order to sign certificates with Ed25519 keys, NULL must be passed
as md to X509_sign. This NULL is then passed
(via ASN1_item_sign_ex) as type to EVP_DigestSignInit. The
documentation[1] of EVP_DigestSignInit states that type must be NULL
for various key types, including Ed25519.
[1]: https://www.openssl.org/docs/manmaster/man3/EVP_DigestSignInit.html
https://github.com/ruby/openssl/commit/b0fc100091
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/openssl/ossl_x509cert.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/openssl/ossl_x509cert.c b/ext/openssl/ossl_x509cert.c index dbf83ff525..846dd0701c 100644 --- a/ext/openssl/ossl_x509cert.c +++ b/ext/openssl/ossl_x509cert.c @@ -539,7 +539,11 @@ ossl_x509_sign(VALUE self, VALUE key, VALUE digest) const EVP_MD *md; pkey = GetPrivPKeyPtr(key); /* NO NEED TO DUP */ - md = ossl_evp_get_digestbyname(digest); + if (NIL_P(digest)) { + md = NULL; /* needed for some key types, e.g. Ed25519 */ + } else { + md = ossl_evp_get_digestbyname(digest); + } GetX509(self, x509); if (!X509_sign(x509, pkey, md)) { ossl_raise(eX509CertError, NULL); |