Revert "Recognize critical IssuingDistributionPoint CRL extension"

It might not be a good idea to blindly accept such extensions.  A scoped
CRL could be accepted for the wrong scope.  So just reject them again.

This reverts commit 126778679f.
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:39 +02:00
parent 6971249758
commit 2092fe6722
2 changed files with 0 additions and 7 deletions
@@ -543,10 +543,6 @@ static bool parse_extensions(private_openssl_crl_t *this)
case NID_freshest_crl:
ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris);
break;
case NID_issuing_distribution_point:
/* TODO support of IssuingDistributionPoints */
ok = TRUE;
break;
default:
ok = X509_EXTENSION_get_critical(ext) == 0 ||
!lib->settings->get_bool(lib->settings,
@@ -315,9 +315,6 @@ static bool parse(private_x509_crl_t *this)
}
this->baseCrlNumber = object;
break;
case OID_ISSUING_DIST_POINT:
/* TODO support of IssuingDistributionPoints */
break;
default:
if (critical && lib->settings->get_bool(lib->settings,
"%s.x509.enforce_critical", TRUE, lib->ns))