support for newer SSL certificate types #188
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
more and more CAs are using certificates signed using SHA256 or SHA512, whereas go's X.509 support by default only supports certificates signed with a SHA1 hash. Importing the two hashes causes them to be registered and available to use for x509 which in turn allows connecting to servers using one of these newer certificates
|
I think it'll be preferred for the imports to be combined into the main import bracket at the top. Other than that good spot and fix :) |
|
Nevermind I see this is unused import so the underscore stops that? Learn something new all the time :) Apologies. |
|
Yeah. The underscore is needed for the compiler to be happy. I don't like how importing the file has such wide-ranging side effects, especially considering the fact that the compiler really dislikes unused imports. But that's how the official API works, so that's what we have to put up with :-) |
|
Seems like a harmless bugfix. Merging! |
jordansissel
added a commit
that referenced
this pull request
Apr 4, 2014
support for newer SSL certificate types
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
More and more CAs (also internal ones, possibly most commonly used with logstash-forwarder) are using certificates signed using SHA256 or SHA512, whereas go's X.509 support by default only supports certificates signed with a SHA1 hash.
This leads to logstash-forwarder failing with
The error message isn't very helpful and even if users were capable of easily finding out where the problem is, you can't expect a CA to provide their certificate signed with a different hash, so IMHO these newer certificates should be supported.
Thankfully, supporting them is reduced to importing the two hash functions before connecting.