diff options
| author | Jakub Zelenka <[email protected]> | 2026-07-16 10:02:21 +0200 |
|---|---|---|
| committer | Norbert Pocs <[email protected]> | 2026-07-27 13:50:23 +0200 |
| commit | 47540a76e38317690bff49bf61ecd0242c453280 (patch) | |
| tree | 67b793271045ffae18f2ff86b1474984b0483ffe /apps | |
| parent | crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks (diff) | |
| download | openssl-47540a76e38317690bff49bf61ecd0242c453280.tar.gz openssl-47540a76e38317690bff49bf61ecd0242c453280.zip | |
apps: drop invalid trust setting in check_cert_might_be_valid()
check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with
X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid
trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and
left that error on the error stack, which was then printed via
ERR_print_errors() for every certificate loaded by the x509 app, even on
success.
The intended liberal behavior is already provided by X509_PURPOSE_ANY and
by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call.
Add a test checking that printing certificate info emits nothing on stderr.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Pocs <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Ryan Hooper <[email protected]>
MergeDate: Mon Jul 27 11:50:39 2026
(Merged from https://github.com/openssl/openssl/pull/31968)
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/lib/apps.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/apps/lib/apps.c b/apps/lib/apps.c index b44e4b2bef2..63a8c8c00db 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -2551,7 +2551,6 @@ int check_cert_might_be_valid(BIO *bio, BIO *b_err, X509 *x, const char *checkho X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_PARTIAL_CHAIN); X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_IGNORE_CRITICAL); X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_ALLOW_PROXY_CERTS); - X509_VERIFY_PARAM_set_trust(vpm, X509_TRUST_OK_ANY_EKU); if (!X509_VERIFY_PARAM_set1_ip_asc(vpm, checkip)) { maybe_printf(b_err, "Invalid IP address: %s\n", checkip); |