diff options
author | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-01-27 22:43:23 -0500 |
---|---|---|
committer | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-01-29 10:53:46 -0500 |
commit | aea6116146ef462d11950ebf701e0f56a38b3d75 (patch) | |
tree | 810de6d4e9c918d69c0b8e7a6d2220191c3704e9 /demos | |
parent | d8ca44ba4158a9dafeaa30d3cba6f113904d2aa6 (diff) |
Make it possible to check for explicit auxiliary trust
By default X509_check_trust() trusts self-signed certificates from
the trust store that have no explicit local trust/reject oids
encapsulated as a "TRUSTED CERTIFICATE" object. (See the -addtrust
and -trustout options of x509(1)).
This commit adds a flag that makes it possible to distinguish between
that implicit trust, and explicit auxiliary settings.
With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted
via explicit trust settings.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Diffstat (limited to 'demos')
0 files changed, 0 insertions, 0 deletions