diff options
| author | Jakub Zelenka <[email protected]> | 2026-07-16 10:02:21 +0200 |
|---|---|---|
| committer | Norbert Pocs <[email protected]> | 2026-07-27 13:50:23 +0200 |
| commit | 47540a76e38317690bff49bf61ecd0242c453280 (patch) | |
| tree | 67b793271045ffae18f2ff86b1474984b0483ffe | |
| parent | crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks (diff) | |
| download | openssl-47540a76e38317690bff49bf61ecd0242c453280.tar.gz openssl-47540a76e38317690bff49bf61ecd0242c453280.zip | |
apps: drop invalid trust setting in check_cert_might_be_valid()
check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.
The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.
Add a test checking that printing certificate info emits nothing on stderr.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Pocs <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ryan Hooper <[email protected]>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)
| -rw-r--r-- | apps/lib/apps.c | 1 | ||||
| -rw-r--r-- | test/recipes/25-test_x509.t | 14 |
2 files changed, 13 insertions, 2 deletions
diff --git a/apps/lib/apps.c b/apps/lib/apps.c index b44e4b2bef2..63a8c8c00db 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -2551,7 +2551,6 @@ int check_cert_might_be_valid(BIO *bio, BIO *b_err, X509 *x, const char *checkho X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_PARTIAL_CHAIN); X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_IGNORE_CRITICAL); X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_ALLOW_PROXY_CERTS); - X509_VERIFY_PARAM_set_trust(vpm, X509_TRUST_OK_ANY_EKU); if (!X509_VERIFY_PARAM_set1_ip_asc(vpm, checkip)) { maybe_printf(b_err, "Invalid IP address: %s\n", checkip); diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t index 07d605eff3b..ac90986e444 100644 --- a/test/recipes/25-test_x509.t +++ b/test/recipes/25-test_x509.t @@ -17,7 +17,7 @@ use File::Compare qw/compare_text/; setup("test_x509"); -plan tests => 154; +plan tests => 155; # Prevent MSys2 filename munging for arguments that look like file paths but # aren't @@ -491,6 +491,18 @@ SKIP: { "error loading unsupported sm2 cert"); } +# Printing info about a plain cert must not emit anything on stderr. +subtest "no spurious errors when printing certificate info" => sub { + plan tests => 2; + + my $errfile = "x509-print.err"; + ok(run(app(["openssl", "x509", "-noout", "-serial", + "-in", srctop_file(@certs, "ca-cert.pem")], + stderr => $errfile)), + "x509 -serial succeeds"); + ok(-z $errfile, "x509 -serial produces no output on stderr"); +}; + # 3 tests for -dateopts formats ok(run(app(["openssl", "x509", "-noout", "-dates", "-dateopt", "rfc_822", "-in", srctop_file("test/certs", "ca-cert.pem")])), |