diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-12-01 14:22:16 +0100 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-12-03 15:11:41 +0100 |
| commit | 315c47e00bb953abe8892a3c1272289330b29d23 (patch) | |
| tree | 06306f2d8657241da73abccdb91873cbd2381916 /crypto/x509/x509_cmp.c | |
| parent | 61168b5b8dde03f3b77ddf5e4b1b81c338c01746 (diff) | |
x509_vfy.c: Restore rejection of expired trusted (root) certificate
The certificate path validation procedure specified in RFC 5280 does not
include checking the validity period of the trusted (root) certificate.
Still it is common good practice to perform this check.
Also OpenSSL did this until version 1.1.1h, yet
commit e2590c3a162eb118c36b09c2168164283aa099b4 accidentally killed it.
The current commit restores the previous behavior.
It also removes the cause of that bug, namely counter-intuitive design
of the internal function check_issued(), which was complicated by checks
that actually belong to some other internal function, namely find_issuer().
Moreover, this commit adds a regression check and proper documentation of
the root cert validity period check feature, which had been missing so far.
Fixes #13471
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13585)
Diffstat (limited to 'crypto/x509/x509_cmp.c')
| -rw-r--r-- | crypto/x509/x509_cmp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c index d1600e1e8d..ad620af0af 100644 --- a/crypto/x509/x509_cmp.c +++ b/crypto/x509/x509_cmp.c @@ -135,6 +135,8 @@ int X509_cmp(const X509 *a, const X509 *b) { int rv; + if (a == b) /* for efficiency */ + return 0; /* ensure hash is valid */ if (X509_check_purpose((X509 *)a, -1, 0) != 1) return -2; |