diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2009-06-15 15:00:19 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2009-06-15 15:00:19 +0000 |
commit | f1ed5fa827ac63420ffac8fcc69d5609716ba297 (patch) | |
tree | 35717880999bf122d7aaaa62f1412bbc570f550d /crypto/x509 | |
parent | 5bb9e1b4d4d9fbeed57fb336769255c7217e3665 (diff) |
Update from 0.9.8-stable.
Diffstat (limited to 'crypto/x509')
-rw-r--r-- | crypto/x509/x509_vfy.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 9ff66cff13..dd4065b0ce 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1609,7 +1609,11 @@ static int internal_verify(X509_STORE_CTX *ctx) while (n >= 0) { ctx->error_depth=n; - if (!xs->valid) + + /* Skip signature check for self signed certificates. It + * doesn't add any security and just wastes time. + */ + if (!xs->valid && xs != xi) { if ((pkey=X509_get_pubkey(xi)) == NULL) { @@ -1619,13 +1623,6 @@ static int internal_verify(X509_STORE_CTX *ctx) if (!ok) goto end; } else if (X509_verify(xs,pkey) <= 0) - /* XXX For the final trusted self-signed cert, - * this is a waste of time. That check should - * optional so that e.g. 'openssl x509' can be - * used to detect invalid self-signatures, but - * we don't verify again and again in SSL - * handshakes and the like once the cert has - * been declared trusted. */ { ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE; ctx->current_cert=xs; |