VNX：如何將 SHA1 哈希演演演演算法更改為更強的證書身份驗證，控制站上的 SHA256 哈希演演演演算法適用於 CVE-2004-2761

To see the current settings:
[root@ CA]# openssl x509 -in /nas/http/conf/current.crt -text | grep -i signature
        Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

To view the options:
[root@CA]# openssl dgst -?
unknown option '-?'
options are
-c              to output the digest with separating colons
-d              to output debug info
-hex            output as hex dump
-binary         output in binary form
-sign   file    sign digest using private key in file
-verify file    verify a signature using public key in file
-prverify file  verify a signature using private key in file
-keyform arg    key file format (PEM or ENGINE)
-signature file signature to verify
-binary         output in binary form
-engine e       use engine e, possibly a hardware device.
-md5            to use the md5 message digest algorithm (default)
-md4            to use the md4 message digest algorithm
-md2            to use the md2 message digest algorithm
-sha1           to use the sha1 message digest algorithm
-sha            to use the sha message digest algorithm
-sha224         to use the sha224 message digest algorithm
-sha256         to use the sha256 message digest algorithm
-sha384         to use the sha384 message digest algorithm
-sha512         to use the sha512 message digest algorithm
-ripemd160      to use the ripemd160 message digest algorithm
[root@CA]#

To change the setting, vi /nas/site/CA/ca.cnf  and change defaulf_md = sha1 to sha256.
>>>>>>As a precaution, you can save a copy first to /home/nasadmin:<<<<<<<<

[root@CA]#  cp -p /nas/site/CA/ca.cnf  /home/nasadmin/
[root@CA]#  vi /nas/site/CA/ca.cnf

Example before the change:
[ CA_default ]
dir = /nas/site/CA
database = $dir/index.txt
new_certs_dir = /tmp
certificate = $dir/ca_certificate.pem
serial = $dir/serial
private_key = $dir/key.pem
default_days = 1825
default_md = sha1 <<<<<<<<<<<<<< This is the parameter to change to sha256

Example with the change:
[ CA_default ]
dir = /nas/site/CA
database = $dir/index.txt
new_certs_dir = /tmp
certificate = $dir/ca_certificate.pem
serial = $dir/serial
private_key = $dir/key.pem
default_days = 1825
default_md = sha256  <<<<<<<<<<<<< After the change - the parameter should be this

After that, as root, please run the following command to generate new key/cert and restart the Apache/CIM all at once to apply the change:
[root@CA]#  /nas/http/nas_ezadm/bin/gen_ssl_cert.pl 


To verify the signature on the certificate, re-run the openssl x509 -in /nas/http/conf/current.crt -text | grep -i signature command:
[root@ CA]#  openssl x509 -in /nas/http/conf/current.crt -text | grep -i signature
        Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption