openbsd/src/usr.bin/openssl/x509.c, branch OPENBSD_7_9 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2026-02-08T22:33:14+00:00 openssl x509: Remove legacy call to OBJ_create() 2026-02-08T22:33:14+00:00 kenjiro 2026-02-08T22:33:14+00:00 urn:sha1:d60e25f216aa14981cbcae98be231b0146e7ff2f The OID 2.99999.3 is not required for x509 output handling and is not referenced elsewhere. Remove the OBJ_create() call. ok tb jsing openssl x509: send -text output to the file specified by -out 2026-02-08T22:25:16+00:00 kenjiro 2026-02-08T22:25:16+00:00 urn:sha1:fbe52a57d923d0b51fc6d79f9ebda770455b831f In the x509 command, `-text` output is not written to the file specified by `-out`, whereas in other OpenSSL/LibreSSL subcommands it is. With this change, STDout is removed, and `-text` output is written entirely to the file specified by `-out`, making the behavior consistent with other subcommands. Fix https://github.com/libressl/portable/issues/1228 ok tb jsing openssl x509: zap extra whitespace in usage 2025-01-19T13:14:22+00:00 tb 2025-01-19T13:14:22+00:00 urn:sha1:7fc5f5b18a58cc48fee6da858340245c3bf72503 Remove -C option from "apps" 2025-01-19T10:24:17+00:00 tb 2025-01-19T10:24:17+00:00 urn:sha1:0cf1a1f18dd8b413cf42b5e0e9ef25b5ccdccb58 As far as I can tell, this way of generating "C code" was only used to add stuff to pretty regress and even prettier speed "app" and otherwise it just served to make the library maintainer's lives even more miserable. ok jsing Fix up authority and subject key identifiers in force pubkey mode 2024-12-04T08:14:34+00:00 tb 2024-12-04T08:14:34+00:00 urn:sha1:04e1055747d35d495ce4f3ed035892e86af24dd9 Upstream decided that this nonsense was worth an ABI break and added stuff to the X509_CTX so they could hang the issuer's public key off it so that they could adjust the key identifiers as needed. Let's avoid that and do it the slightly less nasty way by updating the AKI and SKI as needed. We only do this when force pubkey is in place so we don't change the semantics of the batshit crazy config language that nobody understands. ok job openssl x509: rename pub_key to dsa_pub_key 2024-05-27T16:12:55+00:00 tb 2024-05-27T16:12:55+00:00 urn:sha1:41bfb220c6ec8e7aa80470e5eab530a0b43e462f suggested by jsing openssl: avoid shadowed pkeys in x509.c 2024-05-27T16:11:16+00:00 tb 2024-05-27T16:11:16+00:00 urn:sha1:e46750ab520d2ee5e9ab68ebcb1750598fd1f1af ok job jsing Add 'openssl x509 -new' functionality to the libcrypto CLI utility 2024-01-26T11:58:37+00:00 job 2024-01-26T11:58:37+00:00 urn:sha1:c6ef56532943eb3b0c27899a1d3ce888b8aacece The ability to generate a new certificate is useful for testing and experimentation with rechaining PKIs. While there, alias '-key' to '-signkey' for compatibility. with and OK tb@ Add -force_pubkey -multivalue-rdn -set_issuer -set_subject -utf8 to x509 app 2024-01-12T11:24:03+00:00 job 2024-01-12T11:24:03+00:00 urn:sha1:fd3a458c3776b8f3ff79dd8ee79fafe9c6782c8a The -set_issuer, -set_subject, and -force_pubkey features can be used to 'rechain' PKIs, for more information see https://labs.apnic.net/nro-ta/ and https://blog.apnic.net/2023/12/14/models-of-trust-for-the-rpki/ OK tb@ Make a few purpose things const 2023-11-21T17:56:19+00:00 tb 2023-11-21T17:56:19+00:00 urn:sha1:cf8443276e8273969971b03dcddc0d59bc6eb1c9 This should allow us to constify a sizable table in libcrypto in an upcoming bump.