From c735f4947ee0fd770f01a64e83faabefe005e9d4 Mon Sep 17 00:00:00 2001
From: gartens <41197811+gartens@users.noreply.github.com>
Date: Tue, 11 Jun 2024 19:12:23 +0200
Subject: [ruby/openssl] Pass through nil as digest when signing certificates
 (https://github.com/ruby/openssl/pull/761)

In order to sign certificates with Ed25519 keys, NULL must be passed
as md to X509_sign.  This NULL is then passed
(via ASN1_item_sign_ex) as type to EVP_DigestSignInit.  The
documentation[1] of EVP_DigestSignInit states that type must be NULL
for various key types, including Ed25519.

[1]: https://www.openssl.org/docs/manmaster/man3/EVP_DigestSignInit.html

https://github.com/ruby/openssl/commit/b0fc100091
---
 ext/openssl/ossl_x509cert.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'ext')

diff --git a/ext/openssl/ossl_x509cert.c b/ext/openssl/ossl_x509cert.c
index dbf83ff525..846dd0701c 100644
--- a/ext/openssl/ossl_x509cert.c
+++ b/ext/openssl/ossl_x509cert.c
@@ -539,7 +539,11 @@ ossl_x509_sign(VALUE self, VALUE key, VALUE digest)
     const EVP_MD *md;
 
     pkey = GetPrivPKeyPtr(key); /* NO NEED TO DUP */
-    md = ossl_evp_get_digestbyname(digest);
+    if (NIL_P(digest)) {
+        md = NULL; /* needed for some key types, e.g. Ed25519 */
+    } else {
+        md = ossl_evp_get_digestbyname(digest);
+    }
     GetX509(self, x509);
     if (!X509_sign(x509, pkey, md)) {
 	ossl_raise(eX509CertError, NULL);
-- 
cgit v1.2.3