Enable policy checking by default now that we are DAG implementation based.

This ensures that we will no longer silently ignore a certificate with
a critical policy extention by default.

ok tb@

1 files changed, 1 insertions, 4 deletions

diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c
index 9ac3f929dc..4896fe8b7e 100644
--- a/src/lib/libcrypto/x509/x509_vpm.c
+++ b/src/lib/libcrypto/x509/x509_vpm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vpm.c,v 1.36 2023/04/16 19:16:32 tb Exp $ */
+/* $OpenBSD: x509_vpm.c,v 1.37 2023/04/28 16:50:16 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -418,8 +418,6 @@ int
 X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags)
 {
         param->flags |= flags;
-        if (flags & X509_V_FLAG_POLICY_MASK)
-                param->flags |= X509_V_FLAG_POLICY_CHECK;
         return 1;
 }
 LCRYPTO_ALIAS(X509_VERIFY_PARAM_set_flags);
@@ -527,7 +525,6 @@ X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
                         return 0;
                 }
         }
-        param->flags |= X509_V_FLAG_POLICY_CHECK;
         return 1;
 }
 LCRYPTO_ALIAS(X509_VERIFY_PARAM_set1_policies);