SSPCPP-686 - Switch to SHA-2 certs and 3072 bit keys on install

https://issues.shibboleth.net/jira/browse/SSPCPP-686

diff --git a/configs/keygen.bat b/configs/keygen.bat
index ae223a4..14a5fdb 100644 (file)
--- a/configs/keygen.bat
+++ b/configs/keygen.bat
@@ -31,12 +31,12 @@ if not defined FQDN goto guess_fqdn
 :generate
 set PATH=%PATH%;%ProgramFiles%\Shibboleth\SP\lib\
 set CNF="%PREFIX%sp-cert.cnf"
-echo # OpenSSL configuration file for creating sp-cert.pem    >%CNF%
+echo # OpenSSL configuration file for creating keypair       >%CNF%
 echo [req]                                                   >>%CNF%
 echo prompt=no                                               >>%CNF%
-echo default_bits=2048                                       >>%CNF%
+echo default_bits=3072                                       >>%CNF%
 echo encrypt_key=no                                          >>%CNF%
-echo default_md=sha1                                         >>%CNF%
+echo default_md=sha256                                       >>%CNF%
 echo distinguished_name=dn                                   >>%CNF%
 echo # PrintableStrings only                                 >>%CNF%
 echo string_mask=MASK:0002                                   >>%CNF%

diff --git a/configs/keygen.sh b/configs/keygen.sh
index 4ee69f6..002acd9 100755 (executable)
--- a/configs/keygen.sh
+++ b/configs/keygen.sh
@@ -50,12 +50,12 @@ fi
 
 SSLCNF=$OUT/sp-cert.cnf
 cat >$SSLCNF <<EOF
-# OpenSSL configuration file for creating sp-cert.pem
+# OpenSSL configuration file for creating keypair
 [req]
 prompt=no
-default_bits=2048
+default_bits=3072
 encrypt_key=no
-default_md=sha1
+default_md=sha256
 distinguished_name=dn
 # PrintableStrings only
 string_mask=MASK:0002