Currently, the default signature algorithm when creating a new OCSP key binding is SHA1WithRSA or SHA1withECDSA.

According to recommendations (European eIDAS, French RGS, USA NIST), the hash function must have a fingerprint length of 256 bits or more.

Actions:

• Change default OCSP signature algorithms to SHA256WithRSA and SHA256withECDSA

Note:

• Keep SHA1WithDSA for DSA algorithm