denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:45:56 +01:00
parent ece5ac2271
commit dffb176f2b
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_crl.c
+1 -1
View File
@@ -388,7 +388,7 @@ METHOD(certificate_t, issued_by, bool,
{ {
return FALSE; return FALSE;
} }
if (!(x509->get_flags(x509) & X509_CA)) if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN)))
{ {
return FALSE; return FALSE;
} }
src/pki/commands/signcrl.c
+2 -2
View File
@@ -262,9 +262,9 @@ static int sign_crl()
goto error; goto error;
} }
x509 = (x509_t*)ca; x509 = (x509_t*)ca;
if (!(x509->get_flags(x509) & X509_CA)) if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN)))
{ {
error = "CA certificate misses CA basicConstraint"; error = "CA certificate misses CA basicConstraint / CRLSign keyUsage";
goto error; goto error;
} }
public = ca->get_public_key(ca); public = ca->get_public_key(ca);