diff options
author | Matt Caswell <matt@openssl.org> | 2015-01-27 10:35:27 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-02-25 09:14:54 +0000 |
commit | 15dba5be6a4482a9ad7e5b846291f31e97e338ca (patch) | |
tree | 253ce0595f341783c672b4fd2771d6528fd55337 /crypto/x509/x509_vfy.c | |
parent | da084a5ec6cebd67ae27f2463ebe4a50bb840fa5 (diff) |
Add flag to inhibit checking for alternate certificate chains. Setting this
behaviour will force behaviour as per previous versions of OpenSSL
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Diffstat (limited to 'crypto/x509/x509_vfy.c')
-rw-r--r-- | crypto/x509/x509_vfy.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index b986d4c643..bb6e1ce9af 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -357,11 +357,13 @@ int X509_verify_cert(X509_STORE_CTX *ctx) /* * If it's not explicitly trusted then check if there is an alternative * chain that could be used. We only do this if we haven't already - * checked via TRUSTED_FIRST + * checked via TRUSTED_FIRST and the user hasn't switched off alternate + * chain checking */ retry = 0; if (i != X509_TRUST_TRUSTED - && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST)) { + && !(ctx->param->flags & X509_V_FLAG_TRUSTED_FIRST) + && !(ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS)) { while (j-- > 1) { xtmp2 = sk_X509_value(ctx->chain, j - 1); ok = ctx->get_issuer(&xtmp, ctx, xtmp2); |