diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2012-12-13 18:20:47 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2012-12-13 18:20:47 +0000 |
| commit | 2a21cdbe6bd608e62a5daa70309af4982b391dd1 (patch) | |
| tree | d5e5db66aae68ac1822ba8ef8210a2541596da76 /crypto/ocsp | |
| parent | 51e7a4378a78bb0870a2cdc5c524c230c929ebcb (diff) | |
Use new partial chain flag instead of modifying input parameters.
Diffstat (limited to 'crypto/ocsp')
| -rw-r--r-- | crypto/ocsp/ocsp_vfy.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/crypto/ocsp/ocsp_vfy.c b/crypto/ocsp/ocsp_vfy.c index 214b4020fe..2f7f59c59a 100644 --- a/crypto/ocsp/ocsp_vfy.c +++ b/crypto/ocsp/ocsp_vfy.c @@ -111,14 +111,13 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, */ if (chain == certs) goto verified_chain; - /* If we trust some "other" certificates, mark them as - * explicitly trusted (because some of them might be + /* If we trust some "other" certificates, allow partial + * chains (because some of them might be * Intermediate CA Certificates), put them in a store and * attempt to build a trusted chain. */ if ((flags & OCSP_TRUSTOTHER) && (certs != NULL)) { - ASN1_OBJECT *objtmp = OBJ_nid2obj(NID_OCSP_sign); tmpstore = X509_STORE_new(); if (!tmpstore) { @@ -129,7 +128,6 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, for (i = 0; i < sk_X509_num(certs); i++) { X509 *xother = sk_X509_value(certs, i); - X509_add1_trust_object(xother, objtmp); if (!X509_STORE_add_cert(tmpstore, xother)) { ret = -1; @@ -145,6 +143,7 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, goto end; } X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER); + X509_STORE_CTX_set_flags(&ctx, X509_V_FLAG_PARTIAL_CHAIN); ret = X509_verify_cert(&ctx); if (ret == 1) { |