Use SHA256 as default digest for OCSP signing

[samuel40791765]

Description of changes:

OpenSSL apparently sets a default digest when consuming the EVP_DigestSign* APIs. We avoid this and emit a relevant error when this happens. Ruby 3.2's double downed on this on their consumption of OCSP however: ruby/ruby@4d6a293 We don't want to introduce a "default digest" to all calls to EVP_DigestSign*, so I've chosen to imitate OpenSSL's behavior in only the places necessary in this case (OCSP). This fixes the Ruby 3.2 OCSP tests we were failing before.

Call-outs:

N/A

Testing:

Built upon existing OCSP tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 68.75000% with 5 lines in your changes missing coverage. Please review.

Project coverage is 78.66%. Comparing base (8226a05) to head (4a6fea1).

Files with missing lines	Patch %	Lines
crypto/ocsp/ocsp_server.c	75.00%	3 Missing ⚠️
crypto/ocsp/ocsp_client.c	50.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2038      +/-   ##
==========================================
- Coverage   78.67%   78.66%   -0.01%     
==========================================
  Files         598      598              
  Lines      103350   103364      +14     
  Branches    14693    14691       -2     
==========================================
+ Hits        81308    81311       +3     
- Misses      21389    21400      +11     
  Partials      653      653              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[justsmth]

NP: Why have this function take dgst as a parameter? It would seem more natural to have the callers conditionally invoke OCSP_get_default_digest only when dgst is NULL.

[samuel40791765]

Agreed, that was the original way I had implemented it. But we would need double null checks (outlined below) in both functions without the abstraction into OCSP_get_default_digest. It didn't sit quite well with me since we were already trying to abstract out shared logic, which was why I moved it into the static function.

const EVP_MD *init_dgst = dgst;
if (init_dgst != NULL) {
    init_dgst = OCSP_get_default_digest(key);
}
if (init_dgst != NULL) {
  OPENSSL_PUT_ERROR(OCSP, EVP_R_NO_DEFAULT_DIGEST);
   goto err;
}