Title: #837: p11_child: make OCSP digest configurable
@alexey-tikhonov I think you are getting a few things confused here.
The FIPS requirement you referenced is for **cryptographic** hashes. This pull request did
not change _cryptographic_ hashing behavior. Instead, it changed how an OCSP request
_identifies_ a certificate that the OCSP responder needs to validate. That is independent
of which algorithm is used to _cryptographically sign_ the OCSP response that is returned
(or optionally, the OCSP request that is sent).
In addition, some OCSP responders (including Microsoft's) implement RFC 5019, which
places additional restrictions on how OCSP is used. In particular, [Section
states that for OCSP requests,
Clients MUST use SHA1 as the hashing algorithm for the
CertID.issuerNameHash and the CertID.issuerKeyHash values.
So the change here actually breaks compatibility with RFC 5019 responders out-of-the-box.
The fact that this hashing algorithm is configurable in SSSD is fine, but the default
should be changed back to SHA-1. Again, this is not a _cryptographic_ hash.
As an aside, you might wish to add the [Preferred Signature Algorithms
to outgoing OCSP requests
See the full comment at https://github.com/SSSD/sssd/pull/837#issuecomment-673709907