1 files changed, 21 insertions, 1 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 111a845460c9..a799029320d1 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -149,6 +149,26 @@ kernel/modsign_pubkey.o: signing_key.x509 extra_certificates
 # fail and that the kernel may be used afterwards.
 #
 ###############################################################################
+sign_key_with_hash :=
+ifeq ($(CONFIG_MODULE_SIG_SHA1),y)
+sign_key_with_hash := -sha1
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA224),y)
+sign_key_with_hash := -sha224
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA256),y)
+sign_key_with_hash := -sha256
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA384),y)
+sign_key_with_hash := -sha384
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA512),y)
+sign_key_with_hash := -sha512
+endif
+ifeq ($(sign_key_with_hash),)
+$(error Could not determine digest type to use from kernel config)
+endif
+
 signing_key.priv signing_key.x509: x509.genkey
         @echo "###"
         @echo "### Now generating an X.509 key pair to be used for signing modules."
@@ -160,7 +180,7 @@ signing_key.priv signing_key.x509: x509.genkey
         @echo "###"
         @echo "###     rngd -r /dev/hwrandom"
         @echo "###"
-        openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \
+        openssl req -new -nodes -utf8 $(sign_key_with_hash) -days 36500 -batch \
                 -x509 -config x509.genkey \
                 -outform DER -out signing_key.x509 \
                 -keyout signing_key.priv