Get rid of SHA1 for comparing CRL's - use SHA512 just like we do for certs.

ok tb@

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index e60ee25de1..4fd8d78fc3 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_cmp.c,v 1.38 2021/12/12 21:30:14 tb Exp $ */
+/* $OpenBSD: x509_cmp.c,v 1.39 2022/02/24 22:05:06 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -143,7 +143,7 @@ X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
 int
 X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
 {
-        return memcmp(a->sha1_hash, b->sha1_hash, 20);
+        return memcmp(a->hash, b->hash, X509_CRL_HASH_LEN);
 }
 #endif