denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Accept CRLs issued by non-CA certificates with cRLSign keyUsage flag

Browse Source 
The x509 plugin accepted CRL signers since forever, to be precise, since
dffb176f2b ("CRLSign keyUsage or CA basicConstraint are sufficient
for CRL validation")).

References #3529.
This commit is contained in:
Tobias Brunner
2020-10-05 15:39:37 +02:00
parent 428c0b293d
commit 7f170e4c9c
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_crl.c
+1 -1
View File
@@ -303,7 +303,7 @@ METHOD(certificate_t, issued_by, bool,
return FALSE; return FALSE;
} }
x509 = (x509_t*)issuer; x509 = (x509_t*)issuer;
if (!(x509->get_flags(x509) & X509_CA)) if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN)))
{ {
return FALSE; return FALSE;
} }