diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-25 15:37:46 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-11 07:42:22 +0200 |
| commit | 8a639b9d7234ed490f85ea46e4e8c74620452acd (patch) | |
| tree | eed8a164f5d7d89ff6ac066b8d95e93082ba6232 /include | |
| parent | 1e41dadfa7b9f792ed0f4714a3d3d36f070cf30e (diff) | |
check_chain_extensions(): Add check that Basic Constraints of CA cert are marked critical
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/x509_vfy.h | 2 | ||||
| -rw-r--r-- | include/openssl/x509v3.h | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/include/openssl/x509_vfy.h b/include/openssl/x509_vfy.h index ec2021357b..e00d51e06f 100644 --- a/include/openssl/x509_vfy.h +++ b/include/openssl/x509_vfy.h @@ -228,9 +228,9 @@ X509_LOOKUP_ctrl_with_libctx((x), X509_L_ADD_STORE, (name), 0, NULL, \ # define X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER 85 # define X509_V_ERR_MISSING_SUBJECT_KEY_IDENTIFIER 86 # define X509_V_ERR_EMPTY_SUBJECT_ALT_NAME 87 +# define X509_V_ERR_CA_BCONS_NOT_CRITICAL 88 /* Certificate verify flags */ - # ifndef OPENSSL_NO_DEPRECATED_1_1_0 # define X509_V_FLAG_CB_ISSUER_CHECK 0x0 /* Deprecated */ # endif diff --git a/include/openssl/x509v3.h b/include/openssl/x509v3.h index 24f5a361d0..4faca1a2ee 100644 --- a/include/openssl/x509v3.h +++ b/include/openssl/x509v3.h @@ -364,8 +364,7 @@ struct ISSUING_DIST_POINT_st { # define EXFLAG_NSCERT 0x8 # define EXFLAG_CA 0x10 -/* Really self issued not necessarily self signed */ -# define EXFLAG_SI 0x20 +# define EXFLAG_SI 0x20 /* self-issued, maybe not self-signed */ # define EXFLAG_V1 0x40 # define EXFLAG_INVALID 0x80 /* EXFLAG_SET is set to indicate that some values have been precomputed */ @@ -375,8 +374,9 @@ struct ISSUING_DIST_POINT_st { # define EXFLAG_INVALID_POLICY 0x800 # define EXFLAG_FRESHEST 0x1000 -/* Self signed */ -# define EXFLAG_SS 0x2000 +# define EXFLAG_SS 0x2000 /* cert is apparently self-signed */ + +# define EXFLAG_BCONS_CRITICAL 0x10000 # define KU_DIGITAL_SIGNATURE 0x0080 # define KU_NON_REPUDIATION 0x0040 |