Add a -legacy_verify flag to force use of the old validator for debugging

and testing purposes.

ok beck inoguchi jsing

1 files changed, 5 insertions, 1 deletions

diff --git a/src/usr.bin/openssl/verify.c b/src/usr.bin/openssl/verify.c
index 3da41b917a..e4443148ce 100644
--- a/src/usr.bin/openssl/verify.c
+++ b/src/usr.bin/openssl/verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.8 2020/07/14 19:08:30 jsing Exp $ */
+/* $OpenBSD: verify.c,v 1.9 2020/10/26 11:48:39 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -193,6 +193,10 @@ static const struct option verify_shared_options[] = {
                 .desc = "Enable debugging of certificate issuer checks",
         },
         {
+                .name = "legacy_verify",
+                .desc = "Use legacy certificate chain verification",
+        },
+        {
                 .name = "policy",
                 .argname = "name",
                 .desc = "Add given policy to the acceptable set",