Fail on critical extensions in openssl CRLs

2011-01-05 16:46:03 +01:00
parent 51b7e9ce72
commit e24a02a28f
1 changed files with 6 additions and 1 deletions
@@ -458,7 +458,12 @@ static bool parse_extensions(private_openssl_crl_t *this)
 					ok = parse_crlNumber_ext(this, ext);
 					break;
 				default:
-					ok = TRUE;
+					ok = X509_EXTENSION_get_critical(ext) != 0;
+					if (!ok)
+					{
+						DBG1(DBG_LIB, "found unsupported critical X.509 "
+							 "CRL extension");
+					}
 					break;
 			}
 			if (!ok)