summaryrefslogtreecommitdiff
path: root/src/usr.sbin
diff options
context:
space:
mode:
authortb <>2020-06-10 03:56:22 +0000
committertb <>2020-06-10 03:56:22 +0000
commita91baa573ac5ab1cbde7a2761d1d1da9501f45ec (patch)
tree4521a19cf622bb9e5f326c41d51cdf799d53192e /src/usr.sbin
parentf21616a5b0676fecb01b51cf6ce47840065457ef (diff)
downloadopenbsd-a91baa573ac5ab1cbde7a2761d1d1da9501f45ec.tar.gz
openbsd-a91baa573ac5ab1cbde7a2761d1d1da9501f45ec.tar.bz2
openbsd-a91baa573ac5ab1cbde7a2761d1d1da9501f45ec.zip
OpenBSD 6.7 errata 010, June 11, 2020 (6.7/010_x509.patch.sig)libressl-v3.1.3
original commit: CVSROOT: /cvs Module name: src Changes by: jsing@cvs.openbsd.org 2020/05/31 11:23:39 Modified files: lib/libcrypto/x509: x509_vfy.c Log message: When building a chain look for non-expired certificates first. Currently, when building a certificate chain we look up an issuer and if it is the only issuer certificate available we still use it even if it has expired. When X509_V_FLAG_TRUSTED_FIRST is not in use, untrusted certificates are processed first and if one of these happens to be expired it will be used to build the chain, even if there is another non-expired option in the trusted store. Rework this code so that we first look for a non-expired untrusted certificate. If one does not exist then we take a look in the trusted store to see if we would be able to build the chain and only if there is not, do we then look for an expired untrusted certificate. This makes certificate validation possible for various sites that are serving expired AddTrust certificates. Issue reported by Christian Heimes via GitHub. ok beck@ tb@
Diffstat (limited to 'src/usr.sbin')
0 files changed, 0 insertions, 0 deletions