diff options
| author | Matt Caswell <matt@openssl.org> | 2021-07-05 17:19:59 +0100 |
|---|---|---|
| committer | Pauli <pauli@openssl.org> | 2021-07-09 10:24:32 +1000 |
| commit | be618c7cc18ab0cbaf0538128705de7f60975ad7 (patch) | |
| tree | b1a48bbba576acb8c2446e71ae9cde6223b71600 /apps/pkcs12.c | |
| parent | 5c8c2e6b484d5845cc26a0b634c872e2d102037a (diff) | |
Don't add the first pkcs12 certificate multiple times
This fixes a regression introduced by commit 1d6c867. When exporting a set
of certificates to a PKCS12 file we shouldn't add the first one twice. Also
we restore historic behaviour with respect to the canames option where we
have no ee certificate with key.
Fixes #15983
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16001)
Diffstat (limited to 'apps/pkcs12.c')
| -rw-r--r-- | apps/pkcs12.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/apps/pkcs12.c b/apps/pkcs12.c index 1234a69892..d745df8494 100644 --- a/apps/pkcs12.c +++ b/apps/pkcs12.c @@ -571,8 +571,6 @@ int pkcs12_main(int argc, char **argv) infile); goto export_end; } - } else { - ee_cert = X509_dup(sk_X509_value(certs, 0)); /* take 1st cert */ } } @@ -588,8 +586,13 @@ int pkcs12_main(int argc, char **argv) int vret; STACK_OF(X509) *chain2; X509_STORE *store; + X509 *ee_cert_tmp = ee_cert; + + /* Assume the first cert if we haven't got anything else */ + if (ee_cert_tmp == NULL && certs != NULL) + ee_cert_tmp = sk_X509_value(certs, 0); - if (ee_cert == NULL) { + if (ee_cert_tmp == NULL) { BIO_printf(bio_err, "No end entity certificate to check with -chain\n"); goto export_end; @@ -600,7 +603,7 @@ int pkcs12_main(int argc, char **argv) == NULL) goto export_end; - vret = get_cert_chain(ee_cert, store, untrusted_certs, &chain2); + vret = get_cert_chain(ee_cert_tmp, store, untrusted_certs, &chain2); X509_STORE_free(store); if (vret == X509_V_OK) { |