openssl/apps, branch OpenSSL_1_1_1t

Update copyright year

2022-10-11T12:26:59Z

Reviewed-by: Richard Levitte Release: yes (Merged from https://github.com/openssl/openssl/pull/19383)

Fix re-signing certificates with different key sizes

2022-07-22T18:41:44Z

PR #18129 broke the scenario of signing a certificate (not CSR) with different-sized key. This works in 3.0, so port the fix from 3.0 (which is to only update the issuer for a request). Partially undo #18129, but keep setting the issuer only for a CSR Create two certs (a and ca) then sign a with c (into b): ``` openssl req -x509 -newkey rsa:2048 -keyout a-key.pem -out a-cert.pem -days 365 -nodes -subj /CN=a.example.com openssl req -x509 -newkey rsa:4096 -keyout ${HERE}/ca-key.pem -out ${HERE}/ca-cert.pem -days 3650 -nodes -subj /CN=ca.example.com openssl x509 -in a-cert.pem -CA ca-cert.pem -CAkey ca-key.pem -set_serial '1234567890' -preserve_dates -sha256 -out b-cert.pem ``` The above succeeds in 1.1.1n and 3.0, fails in 1.1.1o (which includes #18129) The issue in #16080 is also fixed. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Ben Kaduk (Merged from https://github.com/openssl/openssl/pull/18836)

Fix verify_callback in the openssl s_client/s_server app

2022-07-20T06:38:45Z

We need to check that error cert is available before printing its data Reviewed-by: Tomas Mraz Reviewed-by: David von Oheimb Reviewed-by: Viktor Dukhovni Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/18805) (cherry picked from commit fad0f80eff188ef938fed614245a56ed56110deb)

APPS/x509: With -CA but both -CAserial and -CAcreateserial not given, use random serial.

2022-07-14T13:02:57Z

Also improve openssl-x509.pod.in and error handling of load_serial() in apps.c. Backported from https://github.com/openssl/openssl/pull/18373 Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/18803)

Fixes OSCP->OCSP typo in ocsp command line

2022-07-06T08:19:02Z

The existing help text says: > -badsig Corrupt last byte of loaded OSCP response signature (for test) but this should be OCSP. This is the only occurrence within the project of this typo. CLA: trivial Signed-off-by: Alexander Scheel Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/18684) (cherry picked from commit 2837b19fcba4bf4ff2ecdc8435c650bf18c27552)

Update copyright year

2022-06-21T13:13:56Z

Reviewed-by: Richard Levitte Release: yes

s_serve: Report an error if init-connection fails without an attempt to read.

2022-05-19T10:37:35Z

Fixes: openssl#18047. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18283)

Update copyright year

2022-05-03T12:38:37Z

Reviewed-by: Tomas Mraz Release: yes

x509: use actual issuer name if a CA is used

2022-04-25T12:02:14Z

Fixes openssl#16080. Reviewed-by: Ben Kaduk Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18129)

Check password length only when verify is enabled.

2022-03-17T13:41:07Z

Fixes #16231. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/17899)