Problems in accessing CNAF SE with dirac proxy used by fts

[zhangxiaomei]

When the proxy generated by DIRAC is sent to FTS, the proxy in FTS has problems to access CNAF SE. With the proxy generated directly from "voms-proxy-init" with dirac client, it is working fine in fts to access CNAF SE. The difference between these two proxies is the former one with sha1 signature and the latter one with sha256 signature. Could be the reason for the failure?
By the way, other SEs are working fine with both proxies.

[marianne013]

I realise this is not particularly helpful, but where do you get the SHA1 proxy from ? My DIRAC server doesn't seem to do this.
Do you happen to have a really old diracos install ?

[zhangxiaomei]

It looks like not related with DIRAC server and client. Using the dirac proxy without dirac client to submit a fts transfer also created a proxy in fts with sha1 signature. Even this dirac proxy has sha256 signature.

[zhangxiaomei]

After CNAF SE added sha1 support to their SE servers, the problems are solved. But Andrei and I still don't know why the DIRAC proxy creats a proxy with sha1 signature in FTS. Maybe Chirstophe know more?

[sfayer]

We had a problem with the FTS client libraries generating SHA1 proxies about 6 months ago which was fixed by upgrading DIRACOS to 2.42, which could be related? See the end of ticket #7665 which has a file path you can check if it contains "sha1" or not for the FTS delegation.

Regards,
Simon

[zhangxiaomei]

It could be. I saw " proxy.sign(self.context.evp_key, "sha1") " in our diracos too. By the way, how to upgrade DIRACOS seperately without upgrading DIRAC?