1a7b91
diff -up openssl-1.1.1/crypto/x509/x509_vfy.c.seclevel openssl-1.1.1/crypto/x509/x509_vfy.c
1a7b91
--- openssl-1.1.1/crypto/x509/x509_vfy.c.seclevel	2018-09-11 14:48:22.000000000 +0200
143a3d
+++ openssl-1.1.1/crypto/x509/x509_vfy.c	2018-09-14 11:47:39.715317617 +0200
1a7b91
@@ -3220,6 +3220,7 @@ static int build_chain(X509_STORE_CTX *c
1a7b91
 }
1a7b91
 
1a7b91
 static const int minbits_table[] = { 80, 112, 128, 192, 256 };
1a7b91
+static const int minbits_digest_table[] = { 80, 80, 128, 192, 256 };
1a7b91
 static const int NUM_AUTH_LEVELS = OSSL_NELEM(minbits_table);
1a7b91
 
1a7b91
 /*
1a7b91
@@ -3264,6 +3265,8 @@ static int check_sig_level(X509_STORE_CT
1a7b91
 
1a7b91
     if (!X509_get_signature_info(cert, NULL, NULL, &secbits, NULL))
1a7b91
         return 0;
1a7b91
-
1a7b91
-    return secbits >= minbits_table[level - 1];
1a7b91
+    /* Allow SHA1 in SECLEVEL 2 in non-FIPS mode */
1a7b91
+    if (FIPS_mode())
1a7b91
+        return secbits >= minbits_table[level - 1];
1a7b91
+    return secbits >= minbits_digest_table[level - 1];
1a7b91
 }
1a7b91
diff -up openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod.seclevel openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod
1a7b91
--- openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod.seclevel	2018-09-11 14:48:22.000000000 +0200
143a3d
+++ openssl-1.1.1/doc/man3/SSL_CTX_set_security_level.pod	2018-09-14 11:47:39.715317617 +0200
1a7b91
@@ -81,8 +81,10 @@ using MD5 for the MAC is also prohibited
1a7b91
 
1a7b91
 =item B<level 2="">
1a7b91
 
1a7b91
-Security level set to 112 bits of security. As a result RSA, DSA and DH keys
1a7b91
-shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited.
1a7b91
+Security level set to 112 bits of security with the exception of SHA1 allowed
1a7b91
+for signatures.
1a7b91
+As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys
1a7b91
+shorter than 224 bits are prohibited.
1a7b91
 In addition to the level 1 exclusions any cipher suite using RC4 is also
1a7b91
 prohibited. SSL version 3 is also not allowed. Compression is disabled.
1a7b91
 
1a7b91
diff -up openssl-1.1.1/ssl/ssl_cert.c.seclevel openssl-1.1.1/ssl/ssl_cert.c
1a7b91
--- openssl-1.1.1/ssl/ssl_cert.c.seclevel	2018-09-11 14:48:23.000000000 +0200
143a3d
+++ openssl-1.1.1/ssl/ssl_cert.c	2018-09-14 11:47:39.716317598 +0200
1a7b91
@@ -983,6 +983,9 @@ static int ssl_security_default_callback
1a7b91
             return 0;
1a7b91
         break;
1a7b91
     default:
1a7b91
+        /* allow SHA1 in SECLEVEL 2 in non FIPS mode */
1a7b91
+        if (nid == NID_sha1 && minbits == 112 && !FIPS_mode())
1a7b91
+            break;
1a7b91
         if (bits < minbits)
1a7b91
             return 0;
1a7b91
     }
143a3d
diff -up openssl-1.1.1/test/recipes/25-test_verify.t.seclevel openssl-1.1.1/test/recipes/25-test_verify.t
143a3d
--- openssl-1.1.1/test/recipes/25-test_verify.t.seclevel	2018-09-11 14:48:24.000000000 +0200
143a3d
+++ openssl-1.1.1/test/recipes/25-test_verify.t	2018-09-14 12:36:40.021812399 +0200
143a3d
@@ -342,8 +342,8 @@ ok(verify("ee-pss-sha1-cert", "sslserver
143a3d
 ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], ),
143a3d
     "CA with PSS signature using SHA256");
143a3d
 
143a3d
-ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
143a3d
-    "Reject PSS signature using SHA1 and auth level 2");
143a3d
+ok(!verify("ee-pss-sha1-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "3"),
143a3d
+    "Reject PSS signature using SHA1 and auth level 3");
143a3d
 
143a3d
 ok(verify("ee-pss-sha256-cert", "sslserver", ["root-cert"], ["ca-cert"], "-auth_level", "2"),
143a3d
     "PSS signature using SHA256 and auth level 2");