diff options
| -rw-r--r-- | apps/verify.c | 8 | ||||
| -rw-r--r-- | crypto/x509/x509_vfy.c | 5 | ||||
| -rw-r--r-- | doc/apps/verify.pod | 9 | ||||
| -rw-r--r-- | doc/crypto/X509_STORE_CTX_new.pod | 9 | ||||
| -rw-r--r-- | include/openssl/x509_vfy.h | 1 |
5 files changed, 30 insertions, 2 deletions
diff --git a/apps/verify.c b/apps/verify.c index f6cea31f40..a823d58a75 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -244,6 +244,7 @@ static int check(X509_STORE *ctx, char *file, int i = 0, ret = 0; X509_STORE_CTX *csc; STACK_OF(X509) *chain = NULL; + int num_untrusted; x = load_cert(file, FORMAT_PEM, NULL, e, "certificate file"); if (x == NULL) @@ -265,8 +266,10 @@ static int check(X509_STORE *ctx, char *file, if (crls) X509_STORE_CTX_set0_crls(csc, crls); i = X509_verify_cert(csc); - if (i > 0 && show_chain) + if (i > 0 && show_chain) { chain = X509_STORE_CTX_get1_chain(csc); + num_untrusted = X509_STORE_CTX_get_num_untrusted(csc); + } X509_STORE_CTX_free(csc); ret = 0; @@ -284,6 +287,9 @@ static int check(X509_STORE *ctx, char *file, X509_NAME_print_ex_fp(stdout, X509_get_subject_name(cert), 0, XN_FLAG_ONELINE); + if (i < num_untrusted) { + printf(" (untrusted)"); + } printf("\n"); } sk_X509_pop_free(chain, X509_free); diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 7222113c68..df012ddeb0 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -2452,6 +2452,11 @@ int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx) return ctx->explicit_policy; } +int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx) +{ + return ctx->last_untrusted; +} + int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) { const X509_VERIFY_PARAM *param; diff --git a/doc/apps/verify.pod b/doc/apps/verify.pod index 242b9ee9fa..9cc7fcb817 100644 --- a/doc/apps/verify.pod +++ b/doc/apps/verify.pod @@ -42,6 +42,7 @@ B<openssl> B<verify> [B<-verify_ip ip>] [B<-verify_name name>] [B<-x509_strict>] +[B<-show_chain>] [B<->] [certificates] @@ -227,6 +228,12 @@ Supported usages include: default, pkcs7, smime_sign, ssl_client, ssl_server. For strict X.509 compliance, disable non-compliant workarounds for broken certificates. +=item B<-show_chain> + +Display information about the certificate chain that has been built (if +successful). Certificates in the chain that came from the untrusted list will be +flagged as "untrusted". + =item B<-> Indicates the last option. All arguments following this are assumed to be @@ -491,6 +498,6 @@ L<x509(1)|x509(1)> =head1 HISTORY -The -no_alt_chains options was first added to OpenSSL 1.1.0. +The -show_chain option was first added to OpenSSL 1.1.0. =cut diff --git a/doc/crypto/X509_STORE_CTX_new.pod b/doc/crypto/X509_STORE_CTX_new.pod index 7c154572ec..f8907d7ebb 100644 --- a/doc/crypto/X509_STORE_CTX_new.pod +++ b/doc/crypto/X509_STORE_CTX_new.pod @@ -25,6 +25,8 @@ X509_STORE_CTX_new, X509_STORE_CTX_cleanup, X509_STORE_CTX_free, X509_STORE_CTX_ void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param); int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name); + int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx); + =head1 DESCRIPTION These functions initialise an B<X509_STORE_CTX> structure for subsequent use @@ -76,6 +78,9 @@ X509_STORE_CTX_set_default() looks up and sets the default verification method to B<name>. This uses the function X509_VERIFY_PARAM_lookup() to find an appropriate set of parameters from B<name>. +X509_STORE_CTX_get_num_untrusted() returns the number of untrusted certificates +that were used in building the chain following a call to X509_verify_cert(). + =head1 NOTES The certificates and CRLs in a store are used internally and should B<not> @@ -116,6 +121,9 @@ values. X509_STORE_CTX_set_default() returns 1 for success or 0 if an error occurred. +X509_STORE_CTX_get_num_untrusted() returns the number of untrusted certificates +used. + =head1 SEE ALSO L<X509_verify_cert(3)|X509_verify_cert(3)> @@ -124,5 +132,6 @@ L<X509_VERIFY_PARAM_set_flags(3)|X509_VERIFY_PARAM_set_flags(3)> =head1 HISTORY X509_STORE_CTX_set0_crls() was first added to OpenSSL 1.0.0 +X509_STORE_CTX_get_num_untrusted() was first added to OpenSSL 1.1.0 =cut diff --git a/include/openssl/x509_vfy.h b/include/openssl/x509_vfy.h index 4ad20296f8..8e0a225400 100644 --- a/include/openssl/x509_vfy.h +++ b/include/openssl/x509_vfy.h @@ -528,6 +528,7 @@ void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx, X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx); int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx); +int X509_STORE_CTX_get_num_untrusted(X509_STORE_CTX *ctx); X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx); void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param); |