denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Fix regression introduced by commit a22147a

Browse Source 
Instead of the CA certificate's subjectKeyIdentifier erroneously
the CA's authorityKeyIdentifier was used as the authorityKeyIdentfier
of the certificate to be issued. This might work with a root CA
where the authorityKeyIdentifier equals its subjectKeyIdentfier
but introduces a severe regression when an intermediate CA is used.
This commit is contained in:
Andreas Steffen
2023-11-14 08:00:27 +01:00
parent a1224b6c80
commit 6941dcb17a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_cert.c
+1 -1
View File
@@ -2432,7 +2432,7 @@ static bool generate(private_x509_cert_t *cert, certificate_t *sign_cert,
if (sign_cert->get_type(sign_cert) == CERT_X509)
{
keyid = sign_x509->get_authKeyIdentifier(sign_x509);
keyid = sign_x509->get_subjectKeyIdentifier(sign_x509);
}
if (keyid.len ||
sign_key->get_fingerprint(sign_key, KEYID_PUBKEY_SHA1, &keyid))