diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-12-04 11:01:08 +0100 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-12-10 15:19:55 +0100 |
| commit | d858e743a9efa9d6282fdb84f3160b485bafc866 (patch) | |
| tree | 4059e9d83119ad7b8787e429d4f690b4a3fafae2 /apps/req.c | |
| parent | e9701a0141313d2c7008c6ee6d821ba80b3a14d9 (diff) | |
apps/{req,x509,ca}.c: Clean up code setting X.509 cert version v3
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13614)
Diffstat (limited to 'apps/req.c')
| -rw-r--r-- | apps/req.c | 22 |
1 files changed, 15 insertions, 7 deletions
diff --git a/apps/req.c b/apps/req.c index 713d8daf54..27cfbd6017 100644 --- a/apps/req.c +++ b/apps/req.c @@ -744,9 +744,6 @@ int req_main(int argc, char **argv) goto end; /* Set version to V3 */ - if ((extensions != NULL || addext_conf != NULL) - && !X509_set_version(x509ss, 2)) - goto end; if (serial != NULL) { if (!X509_set_serialNumber(x509ss, serial)) goto end; @@ -1708,14 +1705,25 @@ static int do_sign_init(EVP_MD_CTX *ctx, EVP_PKEY *pkey, && do_pkey_ctx_init(pkctx, sigopts); } -int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md, +/* Ensure RFC 5280 compliance and then sign the certificate info */ +int do_X509_sign(X509 *cert, EVP_PKEY *pkey, const EVP_MD *md, STACK_OF(OPENSSL_STRING) *sigopts) { - int rv = 0; + const STACK_OF(X509_EXTENSION) *exts = X509_get0_extensions(cert); EVP_MD_CTX *mctx = EVP_MD_CTX_new(); + int rv = 0; - if (do_sign_init(mctx, pkey, md, sigopts) > 0) - rv = (X509_sign_ctx(x, mctx) > 0); + if (sk_X509_EXTENSION_num(exts /* may be NULL */) > 0) { + /* Prevent X509_V_ERR_EXTENSIONS_REQUIRE_VERSION_3 */ + if (!X509_set_version(cert, 2)) /* Make sure cert is X509 v3 */ + goto end; + + /* TODO any further measures for ensuring default RFC 5280 compliance */ + } + + if (mctx != NULL && do_sign_init(mctx, pkey, md, sigopts) > 0) + rv = (X509_sign_ctx(cert, mctx) > 0); + end: EVP_MD_CTX_free(mctx); return rv; } |