diff options
| author | Todd Short <tshort@akamai.com> | 2022-07-20 16:42:50 -0400 |
|---|---|---|
| committer | Todd Short <todd.short@me.com> | 2022-07-22 14:41:44 -0400 |
| commit | 952fab01bebb15a8408c6ac27b59c28c979f7d49 (patch) | |
| tree | b8d751c4495543294aa407c26dc3b237a5fa6545 /apps | |
| parent | 5ba7a33adca93e9e73a908f82c7df3a139d30b83 (diff) | |
Fix re-signing certificates with different key sizes
PR #18129 broke the scenario of signing a certificate (not CSR) with
different-sized key. This works in 3.0, so port the fix from 3.0
(which is to only update the issuer for a request).
Partially undo #18129, but keep setting the issuer only for a CSR
Create two certs (a and ca) then sign a with c (into b):
```
openssl req -x509 -newkey rsa:2048 -keyout a-key.pem -out a-cert.pem -days 365 -nodes -subj /CN=a.example.com
openssl req -x509 -newkey rsa:4096 -keyout ${HERE}/ca-key.pem -out ${HERE}/ca-cert.pem -days 3650 -nodes -subj /CN=ca.example.com
openssl x509 -in a-cert.pem -CA ca-cert.pem -CAkey ca-key.pem -set_serial '1234567890' -preserve_dates -sha256 -out b-cert.pem
```
The above succeeds in 1.1.1n and 3.0, fails in 1.1.1o (which includes #18129)
The issue in #16080 is also fixed.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/18836)
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/x509.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/apps/x509.c b/apps/x509.c index 67a70e7fea..8d4bf71a03 100644 --- a/apps/x509.c +++ b/apps/x509.c @@ -590,7 +590,7 @@ int x509_main(int argc, char **argv) xca = load_cert(CAfile, CAformat, "CA Certificate"); if (xca == NULL) goto end; - if (!X509_set_issuer_name(x, X509_get_subject_name(xca))) + if (reqfile && !X509_set_issuer_name(x, X509_get_subject_name(xca))) goto end; } @@ -993,6 +993,8 @@ static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *diges goto end; } + if (!X509_set_issuer_name(x, X509_get_subject_name(xca))) + goto end; if (!X509_set_serialNumber(x, bs)) goto end; |