diff options
| author | Richard Levitte <levitte@openssl.org> | 2019-01-16 21:54:48 +0100 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2019-01-16 22:00:42 +0100 |
| commit | 04c71d860491fab3ce54a7ead79f68cf35ae76d4 (patch) | |
| tree | 51b8f1bcb2d8636a5cbf8970657e9db5594b2a0f /apps | |
| parent | b36b1632e20f7d218f23c36e9c55ea44e4be7f97 (diff) | |
apps/verify.c: Change an old comment to clarify what the callback does
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/7922)
(cherry picked from commit 9b10986d7742a5105ac8c5f4eba8b103caf57ae9)
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/verify.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/apps/verify.c b/apps/verify.c index 38377a57e4..b2e8b4def1 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -286,16 +286,19 @@ static int cb(int ok, X509_STORE_CTX *ctx) cert_error, X509_STORE_CTX_get_error_depth(ctx), X509_verify_cert_error_string(cert_error)); + + /* + * Pretend that some errors are ok, so they don't stop further + * processing of the certificate chain. Setting ok = 1 does this. + * After X509_verify_cert() is done, we verify that there were + * no actual errors, even if the returned value was positive. + */ switch (cert_error) { case X509_V_ERR_NO_EXPLICIT_POLICY: policies_print(ctx); /* fall thru */ case X509_V_ERR_CERT_HAS_EXPIRED: - - /* - * since we are just checking the certificates, it is ok if they - * are self signed. But we should still warn the user. - */ + /* Continue even if the leaf is a self signed cert */ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: /* Continue after extension errors too */ case X509_V_ERR_INVALID_CA: |