From b640fedb9fc14e2a1a8121399271d054849e13d5 Mon Sep 17 00:00:00 2001 From: Kory Prince Date: Wed, 10 Feb 2021 12:48:35 -0600 Subject: [PATCH] Fix #723 - Update intermediate cert and signature algorithm (#725) * Update vendor signature to SHA256 (issue #723) * Updated Apple WWDR intermediate certificate (issue #723) --- pkg/crypto/mdmcertutil/certutil.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/crypto/mdmcertutil/certutil.go b/pkg/crypto/mdmcertutil/certutil.go index 79c3180a..ac834e4a 100644 --- a/pkg/crypto/mdmcertutil/certutil.go +++ b/pkg/crypto/mdmcertutil/certutil.go @@ -7,7 +7,7 @@ import ( "crypto" "crypto/rand" "crypto/rsa" - "crypto/sha1" + "crypto/sha256" "crypto/x509" "crypto/x509/pkix" "encoding/base64" @@ -72,7 +72,7 @@ func (p *PushCertificateRequest) Encode() ([]byte, error) { } const ( - wwdrIntermediaryURL = "https://developer.apple.com/certificationauthority/AppleWWDRCA.cer" + wwdrIntermediaryURL = "https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer" appleRootCAURL = "http://www.apple.com/appleca/AppleIncRootCertificate.cer" ) @@ -134,9 +134,9 @@ func makeCertChain(mdmPEM, wwdrPEM, rootPEM []byte) string { } func signPushCSR(csrData []byte, key *rsa.PrivateKey) ([]byte, error) { - h := sha1.New() + h := sha256.New() h.Write(csrData) - signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA1, h.Sum(nil)) + signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, h.Sum(nil)) return signature, errors.Wrap(err, "signing push CSR") }