From 01ec54afc9a5ac8d96d1bfdc95765d5c739c2183 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Feb 2023 17:21:15 +0100 Subject: [PATCH] openssl: Only allow certificates with cRLSign keyUsage to sign CRLs --- src/libstrongswan/plugins/openssl/openssl_crl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c index 92f0ab481..907a5fb2a 100644 --- a/src/libstrongswan/plugins/openssl/openssl_crl.c +++ b/src/libstrongswan/plugins/openssl/openssl_crl.c @@ -303,7 +303,7 @@ METHOD(certificate_t, issued_by, bool, return FALSE; } x509 = (x509_t*)issuer; - if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN))) + if (!(x509->get_flags(x509) & X509_CRL_SIGN)) { return FALSE; }