From 559298b53e20096ae869a287569842f8c1ef2281 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 11 Nov 2024 17:30:16 +0100
Subject: [PATCH] x509: Use SHA-256 as default hash/signature algorithm for
 attribute certificates

References strongswan/strongswan#2523
---
 src/libstrongswan/plugins/x509/x509_ac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index 2e370f5a7..3fc5de2f1 100644
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -1156,7 +1156,7 @@ static void add_groups_from_list(private_x509_ac_t *this, linked_list_t *list)
  */
 x509_ac_t *x509_ac_gen(certificate_type_t type, va_list args)
 {
-	hash_algorithm_t digest_alg = HASH_SHA1;
+	hash_algorithm_t digest_alg = HASH_SHA256;
 	private_x509_ac_t *ac;
 
 	ac = create_empty();