From a77dc855f0e71c70dd1e7d06cc7accf28c5ac4e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adrien=20B=C3=A9raud?= <adrien.beraud@savoirfairelinux.com>
Date: Thu, 17 Dec 2020 12:34:51 -0500
Subject: [PATCH] OCSP: use RFC-mandated parameters

* use 32 bytes nounce
* use SHA-1 for the certificate ID
---
 src/crypto.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crypto.cpp b/src/crypto.cpp
index 131970d5..9c2800f7 100644
--- a/src/crypto.cpp
+++ b/src/crypto.cpp
@@ -1042,10 +1042,10 @@ Certificate::generateOcspRequest(gnutls_x509_crt_t& issuer)
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
     std::unique_ptr<struct gnutls_ocsp_req_int, decltype(&gnutls_ocsp_req_deinit)> req(rreq, &gnutls_ocsp_req_deinit);
-    err = gnutls_ocsp_req_add_cert(req.get(), GNUTLS_DIG_SHA512, issuer, cert);
+    err = gnutls_ocsp_req_add_cert(req.get(), GNUTLS_DIG_SHA1, issuer, cert);
     if (err < 0)
         throw CryptoException(gnutls_strerror(err));
-    Blob noncebuf(64);
+    Blob noncebuf(32);
     gnutls_datum_t nonce = { noncebuf.data(), (unsigned)noncebuf.size() };
     err = gnutls_rnd(GNUTLS_RND_NONCE, nonce.data, nonce.size);
     err = gnutls_ocsp_req_set_nonce(req.get(), 0, &nonce);