How can I create a sha256 fingerprint in openssl
openssl, sha256
Solution
How can I create a sha256 fingerprint in openssl
`-sha256` is correct.
There's an example of signing a server's CSR with your own CA using OpenSSL at How do you sign OpenSSL Certificate Signing Requests with your Certification Authority?.
Based on the feedback, it appears SHA1 is hard coded when using `-fingerprint`. Below is from `<openssl dir>/apps/x509.c` (all OpenSSL apps, like `ca`, `x509`, `encrypt`, `decrypt`, etc are located in `apps/`). From around line 935 of `x509.c`:
else if (fingerprint == i)
{
int j;
unsigned int n;
unsigned char md[EVP_MAX_MD_SIZE];
const EVP_MD *fdig = digest;
if (!fdig)
fdig = EVP_sha1();
if (!X509_digest(x,fdig,md,&n))
{
BIO_printf(bio_err,"out of memory\n");
goto end;
}
BIO_printf(STDout,"%s Fingerprint=", OBJ_nid2sn(EVP_MD_type(fdig)));
....
As far as `const EVP_MD *fdig = digest`, `digest` can be set. But I can't tell what switch is supposed to be used. From around line 475:
else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
{
/* ok */
digest=md_alg;
}
That looks broke to me.
Problem
I want to sha256 the fingerprint Use the openssl. I tried, but you have to sha1. What will i do? I'm using OpenSSL 1.0.1f. commands ``` openssl md5 * >rand.dat openssl genrsa -rand rand.dat -aes256 2048 > server.key openssl req -new -key server.key -sha256 -config openssl.cfg > server.csr openssl x509 -fingerprint -sha256 -in server.csr -req -signkey server.key -extensions v3_req -extfile openssl.cfg -out server.cer ``` Changed from The default is the following: ``` [ CA_default ] default_md = sha256 # Change [ req ] req_extensions = v3_req # Uncomment ```