crypto.py generates certs with SHA-1 digest

[Anna Sortland]

nova/crypto.py:generate_winrm_x509_cert() generates certs with default SHA-1 digest.

The call to 'openssl req' does not specify -digest option nor certificate config file sets digest, so certificates are generated with SHA-1 digest. SHA-1 is not considered to be a secure algorithm for certificates' digest.

It would be preferable to:
1) let user specify digest algorithm via a config option
2) default to SHA-256

[Wenzhi Yu (yuywz)]

I think we do NOT need to introduce a new config option for specifying the digest algorithm. Since SHA-256 is considered to be a secure algorithm, we can just use SHA-256 when make "openssl req" call. This can make the code clean and simple.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/246217

[OpenStack Infra (hudson-openstack)]

Change abandoned by Michael Still (<email address hidden>) on branch: master
Review: https://review.openstack.org/246217
Reason: This patch is quite old, so I am abandoning it to keep the review queue manageable. Feel free to restore the change if you're still interested in working on it.

[Maciej Szankin (mszankin)]

This bug report has an assignee for a while now but there is no patch
for that. It looks like that the chance of getting a patch is low.
I'm going to remove the assignee to signal to others that they can take
over if they like.
If you want to work on this, please:
* add yourself as assignee AND
* set the status to "In Progress" AND
* provide a (WIP) patch within the next 2 weeks after that.
If you need assistance, reach out on the IRC channel #openstack-nova or
use the mailing list.

Also tagging as New. It is old and requires to be verified.