Comments (2)
briansmith
commented on August 26, 2024
RSA_PKCS1_2048_8192_SHA1
According to the Chromium developers, it isn't fully web-compatible to remove support for RSA with SHA-1 signatures for TLS 1.2 ServerKeyExchange messages, so I'm going to keep RSA_PKCS1_2048_8192_SHA1 for now. We should add some documentation about how to use it: In particular, it shouldn't be passed as an acceptable certificate signature algorithm, but it may be necessary to pass it to EndEndityCert::verify_signature as an acceptable algorithm if maximum web compatbility is necessary.
However, also according to them, it is web-compatible to remove support for ECDSA-SHA1 and ECDSA-SHA512 signatures, and I've done that for 0.6.0 in these commits:
We still also may remove RSA_PKCS1_2048_8192_SHA1 completely, depending on what our own compatibility testing shows.
from webpki.
briansmith
commented on August 26, 2024
c26bca4 is related to this: It removes support for a legacy RSA-SHA1 algorithm identifier.
from webpki.
Related Issues (20)
- Version 0.22.0 is not pushed / tagged HOT 4
- Help debugging an UnknownIssuer error in PyOxidizer HOT 2
- Wrong license identification on crates.io breaks guix importer HOT 3
- Make it easy to make test cases for PR authors
- Provide an extensible and usable configuration API HOT 3
- From here forward, use git tags for all releases
- Export fields of `cert::Cert` - get certificate alt names
- Is there a version of webpki that builds with ring version "0.17.0-not-released-yet" HOT 2
- Deviations from RFC5280
- Rustls is unable to handle TLS certificates with IP addresses in SAN DNS names HOT 6
- Would be helpful to have support for unrecognized extensions
- TLS error: webpki error: UnsupportedCriticalExtension HOT 1
- Err(UnknownIssuer) occurred when verifying certificate chain HOT 2
- Handling of certificate revocation lists (CRLs)
- Question about BadDer(DNS name) HOT 2
- v1 Certs not being supported? HOT 1
- Support anyPolicy Certificate Policy
- Archive the repository HOT 2
- verify cert run long time when given one faked cert with large intermediate_certs that can't be verified by any anchors HOT 10
- Make `TrustAnchor::try_from_cert_der` less of an attractive nuisance HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from webpki.