diff options
| author | jsing <> | 2021-09-30 18:23:46 +0000 |
|---|---|---|
| committer | jsing <> | 2021-09-30 18:23:46 +0000 |
| commit | df605a0a04ab9d184a3ac9938209976a2a2c4c81 (patch) | |
| tree | de904f0ebe759b5ef03bd034b74864c688b00c8e | |
| parent | e336219a8430405d08b750df18341f125902b52f (diff) | |
| download | openbsd-df605a0a04ab9d184a3ac9938209976a2a2c4c81.tar.gz openbsd-df605a0a04ab9d184a3ac9938209976a2a2c4c81.tar.bz2 openbsd-df605a0a04ab9d184a3ac9938209976a2a2c4c81.zip | |
Enable X509_V_FLAG_TRUSTED_FIRST by default in the legacy verifier.
In order to work around the expired DST Root CA X3 certficiate, enable
X509_V_FLAG_TRUSTED_FIRST in the legacy verifier. This means that the
default chain provided by Let's Encrypt will stop at the ISRG Root X1
intermediate, rather than following the DST Root CA X3 intermediate.
Note that the new verifier does not suffer from this issue, so only a
small number of things will hit this code path.
ok millert@ robert@ tb@
| -rw-r--r-- | src/lib/libcrypto/x509/x509_vpm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c index aaf0a57dcb..42ea6e72c9 100644 --- a/src/lib/libcrypto/x509/x509_vpm.c +++ b/src/lib/libcrypto/x509/x509_vpm.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: x509_vpm.c,v 1.26 2021/04/24 18:10:12 tb Exp $ */ | 1 | /* $OpenBSD: x509_vpm.c,v 1.27 2021/09/30 18:23:46 jsing Exp $ */ |
| 2 | /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL | 2 | /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL |
| 3 | * project 2004. | 3 | * project 2004. |
| 4 | */ | 4 | */ |
| @@ -598,6 +598,7 @@ static const X509_VERIFY_PARAM_ID _empty_id = { NULL }; | |||
| 598 | static const X509_VERIFY_PARAM default_table[] = { | 598 | static const X509_VERIFY_PARAM default_table[] = { |
| 599 | { | 599 | { |
| 600 | .name = "default", | 600 | .name = "default", |
| 601 | .flags = X509_V_FLAG_TRUSTED_FIRST, | ||
| 601 | .depth = 100, | 602 | .depth = 100, |
| 602 | .trust = 0, /* XXX This is not the default trust value */ | 603 | .trust = 0, /* XXX This is not the default trust value */ |
| 603 | .id = vpm_empty_id | 604 | .id = vpm_empty_id |