- Fix to allow test fake sha1 on systems with possible sha1

support. - Fix to use sha256 for unbound-anchor unit test. - Fix unbound-anchor check for return value of X509_NAME_get_text_by_NID of the emailaddress.
2026-08-17 21:25:50 +02:00 · 2026-07-24 11:50:15 +02:00
parent fc3b5b4f63
commit e1e646c6fc
10 changed files with 342 additions and 77 deletions
@@ -8,6 +8,11 @@
 	  and block_aaaa, and uses local-data if present.
 	- set code repository version to 1.26.0.
 	- Update generated man pages.
+	- Fix to allow test fake sha1 on systems with possible sha1
+	  support.
+	- Fix to use sha256 for unbound-anchor unit test.
+	- Fix unbound-anchor check for return value of
+	  X509_NAME_get_text_by_NID of the emailaddress.

 23 July 2026: Wouter
 	- Updated credits for Xuanchao Xie in 22 july changelog.
@@ -1861,10 +1861,10 @@ get_valid_signers(PKCS7* p7, const char* p7signer)
 			}
 #else
 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
-				NID_commonName, buf, (int)sizeof(buf)))
+				NID_commonName, buf, (int)sizeof(buf)) > 0)
 				printf("commonName: %s\n", buf);
 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
-				NID_pkcs9_emailAddress, buf, (int)sizeof(buf)))
+				NID_pkcs9_emailAddress, buf, (int)sizeof(buf)) > 0)
 				printf("emailAddress: %s\n", buf);
 #endif
 		}
@@ -1890,18 +1890,18 @@ get_valid_signers(PKCS7* p7, const char* p7signer)
 		} else {
 #if !defined(HAVE_X509_NAME_GET_TEXT_BY_NID) || defined(DEPRECATED_X509_NAME_GET_TEXT_BY_NID)
 			if(!has_valid_emailaddr(nm, p7signer)) {
-				if(verb) printf("removed cert with wrong name\n");
+				if(verb) printf("removed cert with wrong emailaddress\n");
 				continue; /* wrong name, skip it */
 			}
 #else
-			if(!X509_NAME_get_text_by_NID(nm,
+			if(X509_NAME_get_text_by_NID(nm,
 				NID_pkcs9_emailAddress,
-				buf, (int)sizeof(buf))) {
-				if(verb) printf("removed cert with no name\n");
+				buf, (int)sizeof(buf)) <= 0) {
+				if(verb) printf("removed cert with no emailaddress\n");
 				continue; /* no name, no use */
 			}
 			if(strcmp(buf, p7signer) != 0) {
-				if(verb) printf("removed cert with wrong name\n");
+				if(verb) printf("removed cert with wrong emailaddress\n");
 				continue; /* wrong name, skip it */
 			}
 #endif
@@ -0,0 +1,201 @@
+#!/bin/sh
+
+# run in temp dir.
+# Then for petal, move into basedir.
+# For test_cert.key and test_cert.pem, rename the output files to that.
+# And run signit.sh for both signature files, by commenting infile and outfile.
+# for test_cert.pem it has emailAddress and keyUsage, but petal.pem does not
+# need that.
+
+# settings:
+
+# directory for files
+DESTDIR=.
+
+# issuer and subject name for certificates
+SERVERNAME=petal
+CLIENTNAME=petal
+
+# validity period for certificates
+DAYS=7200
+
+# size of keys in bits
+BITS=3072
+
+# hash algorithm
+HASH=sha256
+
+# base name for unbound server keys
+SVR_BASE=petal
+
+# base name for unbound-control keys
+CTL_BASE=petal
+
+# flag to recreate generated certificates
+RECREATE=0
+
+# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no).
+umask 0027
+
+# end of options
+
+set -eu
+
+cleanup() {
+    echo "removing artifacts"
+
+    rm -rf \
+       server.cnf \
+       client.cnf \
+       "${SVR_BASE}_trust.pem" \
+       "${CTL_BASE}_trust.pem" \
+       "${SVR_BASE}_trust.srl"
+}
+
+fatal() {
+    printf "fatal error: $*\n" >/dev/stderr
+    exit 1
+}
+
+usage() {
+    cat <<EOF
+usage: $0 OPTIONS
+OPTIONS
+-d <dir>  used directory to store keys and certificates (default: $DESTDIR)
+-h        show help notice
+-r        recreate certificates
+EOF
+}
+
+OPTIND=1
+while getopts 'd:hr' arg; do
+    case "$arg" in
+      d) DESTDIR="$OPTARG" ;;
+      h) usage; exit 1 ;;
+      r) RECREATE=1 ;;
+      ?) fatal "'$arg' unknown option" ;;
+    esac
+done
+shift $((OPTIND - 1))
+
+if ! openssl version </dev/null >/dev/null 2>&1; then
+    echo "$0 requires openssl to be installed for keys/certificates generation." >&2
+    exit 1
+fi
+
+echo "setup in directory $DESTDIR"
+cd "$DESTDIR"
+
+trap cleanup INT
+
+# ===
+# Generate server certificate
+# ===
+
+# generate private key; do no recreate it if they already exist.
+if [ ! -f "$SVR_BASE.key" ]; then
+    openssl genrsa -out "$SVR_BASE.key" "$BITS"
+fi
+
+cat >server.cnf <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+x509_extensions=v3_ca
+[req_distinguished_name]
+commonName=$SERVERNAME
+emailAddress=$SERVERNAME
+[v3_ca]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints=critical,CA:TRUE,pathlen:0
+subjectAltName=DNS:$SERVERNAME
+keyUsage = digitalSignature, keyCertSign
+EOF
+
+[ -f server.cnf ] || fatal "cannot create openssl configuration"
+
+if [ ! -f "$SVR_BASE.pem" -o $RECREATE -eq 1 ]; then
+    openssl req \
+            -new -x509 \
+            -key "$SVR_BASE.key" \
+            -config server.cnf  \
+            -days "$DAYS" \
+            -out "$SVR_BASE.pem"
+
+    [ ! -f "SVR_BASE.pem" ] || fatal "cannot create server certificate"
+fi
+
+# ===
+# Generate client certificate
+# ===
+
+# generate private key; do no recreate it if they already exist.
+if [ ! -f "$CTL_BASE.key" ]; then
+    openssl genrsa -out "$CTL_BASE.key" "$BITS"
+fi
+
+cat >client.cnf <<EOF
+[req]
+default_bits=$BITS
+default_md=$HASH
+prompt=no
+distinguished_name=req_distinguished_name
+req_extensions=v3_req
+[req_distinguished_name]
+commonName=$CLIENTNAME
+[v3_req]
+basicConstraints=critical,CA:FALSE
+subjectAltName=DNS:$CLIENTNAME
+EOF
+
+[ -f client.cnf ] || fatal "cannot create openssl configuration"
+
+if [ ! -f "$CTL_BASE.pem" -o $RECREATE -eq 1 ]; then
+    openssl x509 \
+        -addtrust serverAuth \
+        -in "$SVR_BASE.pem" \
+        -out "${SVR_BASE}_trust.pem"
+
+    openssl req \
+            -new \
+            -config client.cnf \
+            -key "$CTL_BASE.key" \
+        | openssl x509 \
+                  -req \
+                  -days "$DAYS" \
+                  -CA "${SVR_BASE}_trust.pem" \
+                  -CAkey "$SVR_BASE.key" \
+                  -CAcreateserial \
+                  -$HASH \
+                  -extfile client.cnf \
+                  -extensions v3_req \
+                  -out "$CTL_BASE.pem"
+
+    [ ! -f "CTL_BASE.pem" ] || fatal "cannot create signed client certificate"
+fi
+
+# remove unused permissions
+chmod o-rw \
+      "$SVR_BASE.pem" \
+      "$SVR_BASE.key"
+chmod g+r,o-rw \
+      "$CTL_BASE.pem" \
+      "$CTL_BASE.key"
+
+cleanup
+
+echo "Setup success. Certificates created. Enable in unbound.conf file to use"
+
+# create trusted usage pem
+# openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"
+
+# see details with openssl x509 -noout -text < $SVR_BASE.pem
+# echo "create $CTL_BASE""_browser.pfx (web client certificate)"
+# echo "create webbrowser PKCS#12 .PFX certificate file. In Firefox import in:"
+# echo "preferences - advanced - encryption - view certificates - your certs"
+# echo "empty password is used, simply click OK on the password dialog box."
+# openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate"
+
@@ -1,21 +1,40 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIDfQIBAAKBwQC1xQ/Kca6zszZbcCtdOTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJ
-RuN+Rm304SonpwghfP2/ULZNnuDgpG03/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1
-QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ867K029ypjOQtAJ85qdO3mERy7TGtdUcu
-O6hLeVet419YeQ2F8cfNxn63d7bOzNGLPW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeU
-J/i4YDWexFYSL+ECAwEAAQKBwCLXXQl+9O+5AEhSnd1Go1Jh0pSA7eBJOuXQcebG
-Rb7ykp+6C4G2NtDziwwPRNdI6wQQQ0sym18RfyVQHydGr78/nbiIbB3HCn5e92Mh
-mefzW6ow9Kvm2txLzGKA1lvoyRbNm81jnG/eygi3u7Nqd5PNv+4dHj2RkTlmxOeh
-qnDMVP5md8uZPv6lYNnrnIzvLCR5vnPNdVwn89AqzI85IcDZdy0R9ZX4NBbsDgAU
-6ig6uXuRXvSGiyJ/OUXSrnogaQJhAOjvkHUhVZQkPOxO90TNH4j0GdKKtbSWxIdz
-lKfuJeBAEqs0TL+C6vbS81Xw3W1alyDdUBk3rJMOBqW6Ryq5HNL+j5H+Jfsh7fvc
-Yle+5wHGci0P9zCFZCrY8It7n9XFIwJhAMfEi6oJa2G8waPJ1bQhxka82Tf9pnKM
-XCn/1BBOFjVIx5F842cpA+zp5a62GENTGYPQTTRBB/2/ZwnW5aIkrlg54AtmbqBZ
-Oh+2kJdJQD/tfoVmc5soUE2ScTHadK5RKwJhAN4w9kjkXS+MSZjX0kIMsBIBVkhh
-C+aREjJqa9ir7/Ey7RvmLXdYuCxtGLRXp7/R8+rjcK49Tx6O+IRJZe042mfhbq3C
-EhS1Tr86f4xXix9EXlDhs9bSxrOgcAN9Dv/opQJhAK7eBcPaav0rVfYh/8emqQHS
-3fJ9Pu6WnzbEksWTFS2ff9KDGCx9YspIFJ5TF/oXDAaumGZdZrlgirm6O1kr8tGY
-F97i04PZl1+bWAaWQH+1TUNI43m2WFUPE7coG2tb8QJgcddDg9VlXliZqgcETZfJ
-kJmYETxrcSn3ao6v116N8yxhEgUgjkmsCTiFgx36iDVnXwK6PIt+sIu8MC7eYNa3
-berrv/M21K0LRn20IWRxvUobG070weHCAgkko7fTWgr2
-----END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDiNGqbEmyFI9QF
+EvWcU36irjzp1W+VMuMHGD5PDYy5ib1QIrUcUQPvWydV4er/6gnpv6VQ+dfOeVlr
+Acu73kdh+N0u5UgjIY9CJnoN12eEGjTrVFlHoA2Ur/TMbN3DW20Nbyi5LUJ8KrGl
+Yg8tPbLqGvfJsIYTspBEzgQcJg5ZTD3YA2ZESrbZe2sOunri0j1myv+EoTqB4nPb
+ShHx8i11IJpUoBEoHoSyMQgEgYJqbmqCHaTGJWNxHUUhI5MmTPEzyrG6T0B3v5Pb
+y1eFOyAU+I4SCs0fqHPg4DbPlNTe/MEBm2LQAVrUFjcFx+Cq75oOa9sVp6xvBmYN
+nMiwGgLJYjN7l0lhRQEtao6tEGQUYbmpKoLQJMsKs6bjs6HK5TXMzQUfHATirmjE
+C1Fcb/eKJ27HNiKS+uw2g9Tpu/af2qKl3ePNUioPbMYtgGhu5csD22heGeilNVtN
+8D47kU0SveXjokV476CecW0SZnN9rVrvd0IqtnU9fMoAQyZE6ScCAwEAAQKCAYAk
+0//fS3qbmp+0S8ftMbLWbaPBNly6X9SSnSHX4Q7eTkyiNWRjPdV0LNUUqHmIPORs
+SCV0L5kxJpSmVV6EMcZRbyEjt3StM5ONY5JPmphh65peDheTD73mTVd/yOG6IrJ4
+k3Z/35yJdrIBiRuLdBYjA00Aa1sI7fOLIDePFasUYtNWzgbia3+lnPBrL3U+ZJhW
+mgpL36wU5XeTZlXRnGpGPY6i5ISmkYFtOYpioWtIRL3WfVkMYZ31FpzgrlgQzknQ
+lrKN2g7/3q0uLlbasgCsAK50hL2f2xxzsALDCGFjDJbwdIZKfdoxRbgS0L7q7gj0
+SUK4fc1obR5qHc2lTuCSzPpionq022ElC0DChupiosyXN4GxNZ2Dwoln4Y5s2YXo
+VTtyYbVEib15WbhHorvfg0QUO00Nwqu+LVTVUXueNre2n507fSiOhCIpbPUWDGz
+RoeRFEP0T9+mzQgXr56TAiYunIat1qVxXrwaSWSXEfInGUTkdRUC4rctv7KJ1nEC
+gcEA8jDTh1OLBG3/JkQxQNOoqFUFssPlJ+z3LcyaNT6bM5lH5Vwn3sGOFWOMLILD
+f/qbGG/1VPVfoCEY1NEkYsocOMtkLIJrIdtD5DOnWz1JJE7Zh2AoWWfIfXd9v5sh
+m1fB3SVa6D9JtGoDnKttMl25Tqf6YehVo35Axxar74k3kC/vuZrp/81iZscdRsyK
+kQh9fPXl4Oqw2cUYdx3L8UprLS4JguvR0zXvbukJ75DjLZELvjnxBbA1vdtyQz58
+2uk1AoHBAO8aP5h08kwTIJCXS6uyAJ0F8F/30srAtchSpzsC3YEEs/Z+43D7W1RR
+Obw4KhVjjmFeh83U8pdEuUEjv3ua52+uoUCqTywe+o180owiWsTDSXVtDHiUD7bu
+x+nRnpk3flZD28GHKLdWMmJvd8DzMgsa9fJIucMYT7xQHzxCW+4nhhBckX9LEH7i
+Jo6MaVuh8b6NuZXOBgU3cp20GTZ3SwRNkKOigctQVZT4A1Vf4ioLrVyhv/LVLBC+
+UvoIu82wawKBwQDakMXU8sgaj0ocNp5caqdigphJ5BACIBBR/LuOIZnezw3bJ3ez
+x+l51ATEhp33+SnOu/sjWO2bjULjjHrRzKP7fVJB+NDGFSMH5rW52W0Qnzggu96u
+EMMWt6d8K3wAvQnvka6gubzCXIo18V7yfTKmkWGcyhe/HElJYmR4H9VNAnXNgsh6
+Wdfb+QWqxxymFotpImD6wdIoNX8GwJU0hHyEoW9j/320ppAV/6k/0fmzPZrjaVbi
+U0uss0ZC+TmkNaECgcB9L6gGYYyOyiDts1k6LvtlOzvMc0uZPmau2J+YJPrmVxkG
+QQ9CE0iRD+oDowBdrH9aeYzu9sSA8Mlx0o6p38O21J625bSILDwQoj72gfI2PO0U
+HyE9bIABzmk7AbZhEA4Eiojffa2St/2vTh9MFcioydfln7Aq9mqg9O41taS+P1FQ
+9bZ0CFA9rphzYA61nEee9kMprPG3/3zyFt5whuru+NF261m7onb8hRHxvD8EtpJx
+AnsmX/gvWAbHxJTXr7sCgcEAp6QAysy0/sgRYvzBkqv05kz4xBqy2a4ZKjnMLEWY
+7MicZiQrkSsEjMNDy20rjXfZbhDJWGVjBOZ1QsYehKhGAIoORXID9B3aZ32m//VU
+IUxkLcrIPLPmfdzZvlRPnQc/TAZNe41BGBa4WlDwTFE9TdpVtTzjW1ac5yBN7sa+
+V7YbBSiOhP+NuqQFQM01aaZCmOetcj70B4SwJVzswhITS0O+7ZAvicGJiQKTUvUY
+ijWm+Luu3QYDc2HBMwUAmHT5
+-----END PRIVATE KEY-----
@@ -1,14 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIICFzCCAUACCQDO660L5y5LGDANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVw
-ZXRhbDAeFw0xMDA5MzAxMzQzMDFaFw0zMDA2MTcxMzQzMDFaMBAxDjAMBgNVBAMT
-BXBldGFsMIHfMA0GCSqGSIb3DQEBAQUAA4HNADCByQKBwQC1xQ/Kca6zszZbcCtd
-OTIH2Uy2gOy/DfabMUU7TmNPm0dVE0NJRuN+Rm304SonpwghfP2/ULZNnuDgpG03
-/32yI7k/VzG6iA4hiF7tT/KAAWC/+2l1QCsawCV2bSrFK0VhcZr7ALqXd8vkDaQ8
-67K029ypjOQtAJ85qdO3mERy7TGtdUcuO6hLeVet419YeQ2F8cfNxn63d7bOzNGL
-PW5xwaCd3UcgD+Ib0k4xfFvbinvPQUeUJ/i4YDWexFYSL+ECAwEAATANBgkqhkiG
-9w0BAQUFAAOBwQBBkX9KDP2RXbg+xPmdJ4P6CwvA5x1LZwC++ydVx4NlvT0pWicD
-ZUnXjcWAJlkeOuUBAqFG7WHTrXpUUAjmdqFVq2yFjteUYBdrFz0RDB2jM9feeKYO
-mTgxdZyT9a6humxCxt5VfgT02axLjm/2AqCyFPMbf4PASoJDln01AEuZLZ8Xl2gV
-bYHMnHTGoD1Hu6FNEzRgkMC6XT8X3YjHvzQhpc/qL5wEfEsinQGdX4twsuWbf8xd
-q7miNnkO8vd0maw=
+MIIERDCCAqygAwIBAgIUY5FZe4tAZd0ITNbceavVGLvEe2QwDQYJKoZIhvcNAQEL
+BQAwEDEOMAwGA1UEAwwFcGV0YWwwHhcNMjYwNzI0MDkwNTMyWhcNNDYwNDEwMDkw
+NTMyWjAQMQ4wDAYDVQQDDAVwZXRhbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCC
+AYoCggGBAOI0apsSbIUj1AUS9ZxTfqKuPOnVb5Uy4wcYPk8NjLmJvVAitRxRA+9b
+J1Xh6v/qCem/pVD51855WWsBy7veR2H43S7lSCMhj0Imeg3XZ4QaNOtUWUegDZSv
+9Mxs3cNbbQ1vKLktQnwqsaViDy09suoa98mwhhOykETOBBwmDllMPdgDZkRKttl7
+aw66euLSPWbK/4ShOoHic9tKEfHyLXUgmlSgESgehLIxCASBgmpuaoIdpMYlY3Ed
+RSEjkyZM8TPKsbpPQHe/k9vLV4U7IBT4jhIKzR+oc+DgNs+U1N78wQGbYtABWtQW
+NwXH4Krvmg5r2xWnrG8GZg2cyLAaAsliM3uXSWFFAS1qjq0QZBRhuakqgtAkywqz
+puOzocrlNczNBR8cBOKuaMQLUVxv94onbsc2IpL67DaD1Om79p/aoqXd481SKg9s
+xi2AaG7lywPbaF4Z6KU1W03wPjuRTRK95eOiRXjvoJ5xbRJmc32tWu93Qiq2dT18
+ygBDJkTpJwIDAQABo4GVMIGSMB0GA1UdDgQWBBSLQ6cvFrU2JiedggRXjiUemV3h
+QzBLBgNVHSMERDBCgBSLQ6cvFrU2JiedggRXjiUemV3hQ6EUpBIwEDEOMAwGA1UE
+AwwFcGV0YWyCFGORWXuLQGXdCEzW3Hmr1Ri7xHtkMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwEAYDVR0RBAkwB4IFcGV0YWwwDQYJKoZIhvcNAQELBQADggGBANj5PXClrk76
+UddT6aniB/VbErfu1MwfyYSGhE4y5VVJVyD+wHYECswdm2IIo/v/4I+4KWgAcGPk
+u+j1B2iXN8sQTe500+KMSRFfaxdbwlX42+oDKwRoz8pwMzETyZYQA4PAE5j2rnjb
+n9USomWzvwavo7GRE6VauBcSAekrNFDjPw43tElmr2TTz4lUFXlvBlQvcbloJ4OU
+60ek8d1erlsLXzAtf4kCFH1aiII0g0fA448gnIOIgT9LiV88smKNDPVqusw9TBd5
+/f1R8ETy7jcIJ9TU34dy6S39s4aUjWUAZMV1TIH3wJPDsE6+1yD5OC5b50akIwpJ
+jO9naDRvgaHIWxJRcREXd+H7IlybL+l+Qq4L4RX583cdL/rZEWdnESgbDq7EkEPn
+ZbpjdM4oNGUlXsrZw0/GFgzYlN2MBFiLht6y2iBbhFxPb2SM3Xx/M5YnsNLym+I/
+m9mck/aeeSEyJ2uIfFfVndfPfqmKxwvoPu0OCv/ppsi+xTvhE6B/UQ==
 -----END CERTIFICATE-----
@@ -1,21 +1,40 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIDfAIBAAKBwQC48GhhmIU66TZKc3QiyF4L5bsm8Aly/y2SzLP+GACepK0OcOtD
-i2sXrTtoJDvGOPZ9ICqmIy8u/Q/cK26txNEeZFcClLcYF/U+NaqjEwrwkHEIgc3g
-8qnKrhzM61I8foAWVT7cqxFHDKYuClNITXk1i//Yzpnf9wvVKQ51W9UOtm/WA7g4
-IDHCuAjocyyNC3B7XqYawFDOsdMI4ZW7hC0hIRQOvBkvbvY8WxmsSkdd30u1KmoI
-Sg4y6OvnikrEEQkCAwEAAQKBwQC3hQlv37RF82sGkm8qnP6Ge+AuEYCu9v44cJ4k
-hZkH1I5OiEtN6anKAwOyolIWsCwZmrP3zW5jCIiWiRr5oReLOzMEwqK2a//XTdYY
-oSr38b3ZHUY59VP8Zq75woMGuNed35kAmGxzDRP1gI/TmvTvaHlqYyvxBtxnZJij
-Za1CrT+a9JvR6hI8xXrE33CF0T6JO1v3v0HeBuve5+83cCHKo+GyqIBjL3FJgefZ
-EsPz6rGnPDKTYgMyaljFV3LI5ikCYQDlaBnyiWk1C7tYO5x3CRoHoiuiiREZCncK
-QkSxjiDoSP0rc+3BQp2kG3yy6S9mN4qMQPELEtBa6bORogxNK+Pxg8TRI/+xgeFt
-bod5Bd4pfl6Y5hXm21JwELFlOzPI3PMCYQDOYK6Z7vegiOJyyAJXMjcI07H8S0Gr
-SZW8f4tHRzO+RrRpR5ANzarELX7nF/Qj5mPXiZNiiMDGocxqkNzIa5HFLOqBhRkv
-o7yC1Cj582dUBFHyEbsZxR6UMTPLdE3UaRMCYACC1Nv3dmaJ2ib+KwEQ4h/2Ooao
-K4OUxGMfdqu2l1gtIXNBVNxDW7qL3SFA57wgj4x0cJUHu7MYJjBC3igl2uIk2wFk
-RSOOGIR35JFec/o/r9JDYPUcs/hP8TU6hokCBQJgHbH/rZqa+vh3TPjGjXFmRdjg
-JWNWwaTG7OaVTd5K7bgSwYtQiQvs5Gl/dxUVRg0ilKLxGB6BTpN9bGAHxLbltK9v
-1s8l/praxyBr/PsvBQHSILi4aU7ZxY0G3OGRSV0NAmBx28Msdgc0yHh3qSkbwVEr
-gr7av1iOH73ee+o4CmMWXYUBHOMW5Su0s0QHjNGDMiRiRoCvzYqdLcJj9/sFJxOT
-CM35WGGeKDMNubX7C6YroQ91q7kUmhi7HHY3QOyhCDU=
-----END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC7Tr0JP6gVKA2Z
+wtpcBmd27WquMfhdfePva0mV6oc+eE+py2gwHBUAVhMnnYAwT/7ziC0a7pel43tS
+NSHgr0oSUZJC2x+gYMKZ341Q+qNFUJTTv+hG41uKwGfcx02+0HuVU1A9m60PNtE2
+oc83Au8RwyPgcuzWwk3hmX6XUrZmz0vrUxbniLF9xl0gWeFFFWVeioItYDVAKxtl
+Ufrb5/9ju3mzfnEtWWEl+qfraA8DFA10BZRVUBKNB7aGc8KDRBwC4yQBHtIu8ob1
+9DGNe2lYnMCHPFR3dsCHjBYbuGf+J66uAxtMu0IygwI3inNtBUTnQ/QVv2fQNJc2
+vL9ic1BHSwi5byPld3igVCc35wmKLgKX0WtQKcuxI1BwYfaMK+jTZl6mQcE4AuMk
+tvhWbbLn7UQxNAe6X2JKM/M7ds1dIjyfL6nuB1yESX+FiRpjOMuRV1BwrPLJNOfl
+C9QkIRgoy1C9WxZUcigeDAApooDls4H/Q16tWdHj8toQWvYKVqMCAwEAAQKCAYBF
+/w+/pA1BEr26Z0nIuA/0Lpb+T+g7r+79Kr/OCV3PJ5DFqCDgUa47eO8hj8c2xr5E
+7e/FL8J2GMOeHgLx/y+UFu2slEyGV4KBlDwwNenL3mgvlXjM/OvZtztZExXnp+t3
+CzJiQ4nxtI+Mdf2E1lDW93Cx0ODXBLesBft7u0o0s2TwpRVbIwcJNJbanxwDABLo
+uKQbJuffefx76Z3wjgsvjwDU5fyPcOZQFhKoczOg995rLCaZlxnHoElCh4H6Ifod
+K9LQAERjLicBtSThAuO+0us353y3dJ6lY3iYsi2u69UBcvFSepzKjFsx/FPv8B8N
+QMmwpfEZvB4ODM7VvZkvmQZcN3HHopRJWVFWkTkCX5A0RXCXO+AaQV+AVJWnGCxj
+dyV6L1qBK/HsyOto9KGIHN1VFj+n4hTthNPWkDE7CkA7gAMomNvmlf6zNOrbwzro
+LznDK7OQC5Qqoge0R+u/l2xgqzIl8hl5jtmwhi6kT47HBBQ1dBKa6M4rNIFRr9EC
+gcEA9CTQHdAax7XcoeETto/TMKKfv0QyfIivscr250/87GNjzsKCK2MxHZ50jmtF
+7Q7iYhepRuvhbvF9h4BwK7fUbi/KQAW4qiVxqi+MfQkoVYdvnLgekhdmnrThqWmf
+p4ZTZ0tBe29m713WdozHZv6nNcyIrt0JXrVvIFDDpil/6ETHa+y6OMiePc8gklDD
+VVCwKpq+F+taFBzfgqNHkdnaMlP/I/35KEQyhV07aLJhR1leExoGkmc7eaK6WqVD
+iQqZAoHBAMRnVukeUNiSPZmC3IyyfD8iMXnjyPmb/+a9LmwaVOs4yjdBUmGTx+ZV
+mnDb94d3ijyshysbjCc8ebZ7FxuXoaIJ7JWYOgTeMJs1JOAoEVsHBtd1W/RpQ8Hr
+NegSwP4cmCzXAQOtenZnCC2QveHlngxk7rUiayj7G4awrJLtyW9Z9WAUokm810Nq
+muUXhHxRobc40H65+qyCuPODKz3wO4Lt5VaYd4vR+wkUFc0IghmRX0HVlVe/q9gA
+JgXwRPfMmwKBwDWRzkh8XSPs95hddqHcNQ664CproFhK9aIhUsO2fVyxAjlf3IgA
+n8pL9m85goJdfbbgUjhJkZFyU4Tj3bj6ARacTdh2aOqMhMA+5qiY1czOhuLwU2Ti
+1ZWFQu6VSn7Lrok/rgKTkxZ6lJA2m5oxziaz1lnoDiJF1ThWAFf5SyN/0/IOY14K
+Rw5w4Ei6h+G0brMqeQNulLlNDI3xncaW8pWQcK9JDt6S+DLjHiH+4fFx3n56e26s
+UBSEbDdvg74SIQKBwQCrCRM2j5/3+eKK/Nrz67snf692Zlduh9uiJL14hrXM4fe3
+hrsnHnrGq2WDQwucfQ11KQnNEIBM6u1TbH4DGVk4s0vEOnzMIHJTt0QVsM7sZoIe
+v6UEg2buSNb48tv+bwhWhCXt/fTXh4InrBSv1DZ+tKbsNrz7QzIFaXXfvhPdVInK
+0i1B6aHMo9mgB4roeG5MEL4AnhUehfhql5/goIQy0NkXQE9bA9GJZmRV2ULy4RYD
+TuxvLguIXxi9sy9cXGECgcEA2MCZvKU9hml/4n1/dEiNvSGEA9rz92Vzsb50yeRM
+3yLTaYe5koVNbag+IpqpCNP4T2xNnWIxv7ceqB78wxWykadF0z5T5I+/HBPYWLms
+mpQPr7grVqcX5gqxJoUwWwxvKLwh5KjqjRX43turXOWlsSHMVNH6KMLt1K3OtArs
+OMROcUcXBJc2hvr+YBeHOpIC1ZlawIr5BRi2FICN7TeIiE3h7VFY0ucAyOOKvfH9
+FzIeEhSTR60ZN1HtILhRJmjG
+-----END PRIVATE KEY-----
@@ -1,15 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIICWTCCAYKgAwIBAgIJAN5YIkuCvJf5MA0GCSqGSIb3DQEBBQUAMCYxDjAMBgNV
-BAMTBXBldGFsMRQwEgYJKoZIhvcNAQkBFgVwZXRhbDAeFw0xMzAxMTcxMTUyNDVa
-Fw0zMjEwMDQxMTUyNDVaMCYxDjAMBgNVBAMTBXBldGFsMRQwEgYJKoZIhvcNAQkB
-FgVwZXRhbDCB3zANBgkqhkiG9w0BAQEFAAOBzQAwgckCgcEAuPBoYZiFOuk2SnN0
-IsheC+W7JvAJcv8tksyz/hgAnqStDnDrQ4trF607aCQ7xjj2fSAqpiMvLv0P3Ctu
-rcTRHmRXApS3GBf1PjWqoxMK8JBxCIHN4PKpyq4czOtSPH6AFlU+3KsRRwymLgpT
-SE15NYv/2M6Z3/cL1SkOdVvVDrZv1gO4OCAxwrgI6HMsjQtwe16mGsBQzrHTCOGV
-u4QtISEUDrwZL272PFsZrEpHXd9LtSpqCEoOMujr54pKxBEJAgMBAAGjDzANMAsG
-A1UdDwQEAwIChDANBgkqhkiG9w0BAQUFAAOBwQCaA3ys5hDPMNV1oXIxH6u2KfAX
-C9tYJId/SR0x8whsZuNaSEZAgImdM5dnyWdjey8Pio772E9/F2aUBGFkdadZx4My
-d7hBfEi/NECEKs86k9g0ijbin41NKtnajb6GwyNQ9vDx7Z5FS8BZ3CD0BZIdCQUE
-gKuDSWBROQU3tqrjdk2QTwGQkj2mgzT871Jn1MwZw0mczPjS1y469Ejym8wi3uCd
-EboDOoGBCpmUQbxBv6JI75cUCdmNNEwjQjZ0XQw=
+MIIEkzCCAvugAwIBAgIUSAvgFLH//MkCJQDFBcJfyjrVJYswDQYJKoZIhvcNAQEL
+BQAwJjEOMAwGA1UEAwwFcGV0YWwxFDASBgkqhkiG9w0BCQEWBXBldGFsMB4XDTI2
+MDcyNDA5NDEyNloXDTQ2MDQxMDA5NDEyNlowJjEOMAwGA1UEAwwFcGV0YWwxFDAS
+BgkqhkiG9w0BCQEWBXBldGFsMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC
+AYEAu069CT+oFSgNmcLaXAZndu1qrjH4XX3j72tJleqHPnhPqctoMBwVAFYTJ52A
+ME/+84gtGu6XpeN7UjUh4K9KElGSQtsfoGDCmd+NUPqjRVCU07/oRuNbisBn3MdN
+vtB7lVNQPZutDzbRNqHPNwLvEcMj4HLs1sJN4Zl+l1K2Zs9L61MW54ixfcZdIFnh
+RRVlXoqCLWA1QCsbZVH62+f/Y7t5s35xLVlhJfqn62gPAxQNdAWUVVASjQe2hnPC
+g0QcAuMkAR7SLvKG9fQxjXtpWJzAhzxUd3bAh4wWG7hn/ieurgMbTLtCMoMCN4pz
+bQVE50P0Fb9n0DSXNry/YnNQR0sIuW8j5Xd4oFQnN+cJii4Cl9FrUCnLsSNQcGH2
+jCvo02ZepkHBOALjJLb4Vm2y5+1EMTQHul9iSjPzO3bNXSI8ny+p7gdchEl/hYka
+YzjLkVdQcKzyyTTn5QvUJCEYKMtQvVsWVHIoHgwAKaKA5bOB/0NerVnR4/LaEFr2
+ClajAgMBAAGjgbgwgbUwHQYDVR0OBBYEFHTJazw63SRJUbZ3slMXV9O9L7JIMGEG
+A1UdIwRaMFiAFHTJazw63SRJUbZ3slMXV9O9L7JIoSqkKDAmMQ4wDAYDVQQDDAVw
+ZXRhbDEUMBIGCSqGSIb3DQEJARYFcGV0YWyCFEgL4BSx//zJAiUAxQXCX8o61SWL
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwEAYDVR0RBAkwB4IFcGV0YWwwCwYDVR0PBAQD
+AgKEMA0GCSqGSIb3DQEBCwUAA4IBgQBYyONVmgUv8mpGTp2U+12e715VDGQLRNEu
+TjGBgpVF4Vebw8E+L++Fzbd0iJVq0o1WzcM3SxdgPr/AZCqgbzHeRx3ZmE/7QNtF
+w+IvOU35VQAYlA3Caz2gYoTLYaCyPF1ZwH7cbviI1pdv1jWotHVYbK/hFXHx1GaF
+as3AHGAr1lGFFrnt0pA3G1VJACGEHOFZRxeDAwnyl9VN/JC8uujaSekA98fzspvk
+fQYTfOAhR4qd9smwg/af/cgJHcFeMbfLWYmeLa01zMR1NypBOdVJQOXCn9bBn6xW
+Niwa9JitzJaK0hRccdOEerw0UI/5s5xCKIYepn5MZ7RlWfarjBTZbVvyzkMMSFa4
+qB39pqLTQtxq3KLDpTs76Q+U9UyuQuxuC2kNyPHmpYgCT/2Aaiezx80GMeEL3XCJ
+L+vmo/3jU6miAXEFZRBCe1z8bwEWb1RiEHh/pVxRbIMRgtGfCQoQwHpZyx9VUWd0
+ZBYZlQ0Ql1YGPEuEWkobTBppzHsaIX8=
 -----END CERTIFICATE-----
@@ -745,11 +745,9 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&(fake_dsa||fake_sha1))
 		return sec_status_secure;
 #endif
-#ifndef USE_SHA1
 	if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3))
 		return sec_status_secure;
-#endif
-	
+
 	if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
 		verbose(VERB_QUERY, "verify: failed to setup key");
 		*reason = "use of key for crypto failed";