2 files changed, 14 insertions, 7 deletions

diff --git a/src/lib/libcrypto/ts/ts_rsp_sign.c b/src/lib/libcrypto/ts/ts_rsp_sign.c
index 828407aa4b..cbd7039abe 100644
--- a/src/lib/libcrypto/ts/ts_rsp_sign.c
+++ b/src/lib/libcrypto/ts/ts_rsp_sign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_sign.c,v 1.24 2021/11/01 20:53:08 tb Exp $ */
+/* $OpenBSD: ts_rsp_sign.c,v 1.25 2021/11/04 23:52:34 beck Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -849,14 +849,18 @@ ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
 {
         ESS_CERT_ID *cid = NULL;
         GENERAL_NAME *name = NULL;
+        unsigned char cert_hash[TS_HASH_LEN];
 
         /* Recompute SHA1 hash of certificate if necessary (side effect). */
         X509_check_purpose(cert, -1, 0);
 
         if (!(cid = ESS_CERT_ID_new()))
                 goto err;
-        if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
-            sizeof(cert->sha1_hash)))
+
+        if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL))
+                goto err;
+
+        if (!ASN1_OCTET_STRING_set(cid->hash, cert_hash, sizeof(cert_hash)))
                 goto err;
 
         /* Setting the issuer/serial if requested. */
diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
index 2e72ff47ae..07578945cb 100644
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ b/src/lib/libcrypto/ts/ts_rsp_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_verify.c,v 1.22 2021/11/01 20:53:08 tb Exp $ */
+/* $OpenBSD: ts_rsp_verify.c,v 1.23 2021/11/04 23:52:34 beck Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -325,10 +325,14 @@ static int
 TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
 {
         int i;
+        unsigned char cert_hash[TS_HASH_LEN];
 
         if (!cert_ids || !cert)
                 return -1;
 
+        if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL))
+                return -1;
+
         /* Recompute SHA1 hash of certificate if necessary (side effect). */
         X509_check_purpose(cert, -1, 0);
 
@@ -337,9 +341,8 @@ TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
                 ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
 
                 /* Check the SHA-1 hash first. */
-                if (cid->hash->length == sizeof(cert->sha1_hash) &&
-                    !memcmp(cid->hash->data, cert->sha1_hash,
-                        sizeof(cert->sha1_hash))) {
+                if (cid->hash->length == TS_HASH_LEN && !memcmp(cid->hash->data,
+                    cert_hash, TS_HASH_LEN)) {
                         /* Check the issuer/serial as well if specified. */
                         ESS_ISSUER_SERIAL *is = cid->issuer_serial;
                         if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))