From: Emilia Kasper <emilia@openssl.org>
Date: Tue, 2 Feb 2016 16:12:45 +0000 (+0100)
Subject: RT 3854: Update apps/req
X-Git-Tag: OpenSSL_1_1_0-pre3~66
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=a76265574398944d686d2d0de9bacca162f555ca

RT 3854: Update apps/req

Change the default keysize to 2048 bits, and the minimum to 512 bits.

Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/apps/req.c b/apps/req.c
index 3ced1706f0..66bcabcdac 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -89,8 +89,8 @@
 #define STRING_MASK     "string_mask"
 #define UTF8_IN         "utf8"
 
-#define DEFAULT_KEY_LENGTH      512
-#define MIN_KEY_LENGTH          384
+#define DEFAULT_KEY_LENGTH      2048
+#define MIN_KEY_LENGTH          512
 
 static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *dn, int mutlirdn,
                     int attribs, unsigned long chtype);
diff --git a/doc/apps/req.pod b/doc/apps/req.pod
index 9593dec2d5..12a0687a8a 100644
--- a/doc/apps/req.pod
+++ b/doc/apps/req.pod
@@ -324,9 +324,12 @@ configuration file values.
 
 =item B<default_bits>
 
-This specifies the default key size in bits. If not specified then
-512 is used. It is used if the B<-new> option is used. It can be
-overridden by using the B<-newkey> option.
+Specifies the default key size in bits.
+
+This option is used in conjunction with the B<-new> option to generate
+a new key. It can be overridden by specifying an explicit key size in
+the B<-newkey> option. The smallest accepted key size is 512 bits. If
+no key size is specified then 2048 bits is used.
 
 =item B<default_keyfile>