The default of the default cert in the router, default_pub_keys.pem, uses SHA1 and fails to load if any of the DEFAULT_CERTIFICATE, DEFAULT_CERTIFICATE_PATH, or DEFAULT_CERTIFICATE_DIR are NOT specified on the router deployment.

This isn't an active problem for our supported router scenarios because default_pub_keys.pem is never used since DEFAULT_CERTIFICATE_DIR is always specified. But it does impact E2E testing such as when we create router deployments with no default cert, which attempts to load default_pub_keys.pem, which HAProxy fails on now because it's SHA1.

So, both a completeness fix, and a fix to help make E2E tests simpler in origin.

    4.16+

    100%

    1. openssl x509 -in ./images/router/haproxy/conf/default_pub_keys.pem  -noout -text     

...
    Signature Algorithm: sha1WithRSAEncryption
...    

...
    Signature Algorithm: sha256WithRSAEncryption
...