URL:
https://github.com/SSSD/sssd/pull/837
Title: #837: p11_child: make OCSP digest configurable
karlg100 commented:
"""
@sumit-bose / @alexey-tikhonov
I just updated the RH bugzilla ticket, but I'll post the same here.
@alexey-tikhonov -
Re you comment
https://bugzilla.redhat.com/show_bug.cgi?id=1718478#c2
OCSP responders are NOT guaranteed to accept SHA2 algorithms, and depends on the
deployment's configuration. We have encountered an issue where an OCSP responder
configured for only SHA1 will deny entry to a system when SHA256 is not enabled. Looking
thru the RFC, I don't see mention of a responder to be required to answer for all hash
types.
I'm sure we're not the only ones noticing this change has broken PKI
authentication, and it may be prudent for p11_child to attempt a fallback back down to
SHA1 if SHA2 OCSP request fails unauthorized.
Also, I've not been able to locate the language in FIPS140 that bans SHA1's use.
Could you please refer to this in the standards document?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/837#issuecomment-672831519