title: Create RSA-SHA1 signature
body: <p>Is it possible to create a RSA-SHA1 signature with a X509-certificate stored in Azure Key Vault? [non-repudiation certificate]</p>
  
  <p>Unfortunately, I can't change the hash-algorithm to SHA256 or something safer, and I really need to store the certficate in Azure Key Vault as Key. </p>
  
  <p>So far I've tried </p>
  
  <pre><code>await kvClient.SignAsync(keyVaultUrl, "RSNULL", digest); // digest = 20byte SHA1
  await kvClient.SignAsync(keyVaultUrl, "RSNULL", ans1Digest); // asn1Digest = 35byte SHA1 wrapped in ANS1 structure
  </code></pre>
  
  <p>The signature length seems to be correct (256 bytes), but verification fails (on a node with a correctly implemented signature-verification implementation).</p>
  
  <p>I've also tried to implement the signature-algorithm  manually like this (using <code>keyVault.EncryptAsync</code>):</p>
  
  <ul>
  <li>Data >> Calculate SHA1 digest</li>
  <li>Wrap SHA1 digest in ASN.1 structure (together with SHA1 object identifier)</li>
  <li>Pad ANS.1 structure so digest matches the key-length of the certificate</li>
  <li>Encrypt the padded ANS1.structure using RSA1_5 >> Signature</li>
  </ul>
  
  <p>I must be doing something wrong. Not sure if all steps are needed.</p>
  
  <p><em>If anyone from Microsoft reads this. Can you implement SHA1 signing even if it isn't considered safe? Pretty, please with sugar on top :-)</em></p>