generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add -no_alt_chains option to apps to implement the new

Browse Source 
X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building
certificate chains, the first chain found will be the one used. Without this
flag, if the first chain found is not trusted then we will keep looking to
see if we can build an alternative chain instead.

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
This commit is contained in:
Matt Caswell
2015-01-27 10:50:38 +00:00
parent 15dba5be6a
commit 25690b7f5f
7 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/apps.c
View File

@@ -2362,6 +2362,8 @@ int args_verify(char ***pargs, int *pargc,
flags |= X509_V_FLAG_SUITEB_192_LOS;
else if (!strcmp(arg, "-partial_chain"))
flags |= X509_V_FLAG_PARTIAL_CHAIN;
else if (!strcmp(arg, "-no_alt_chains"))
flags |= X509_V_FLAG_NO_ALT_CHAINS;
else
return 0;

2
apps/cms.c
View File

@@ -645,6 +645,8 @@ int MAIN(int argc, char **argv)
BIO_printf(bio_err, "-CAfile file trusted certificates file\n");
BIO_printf(bio_err,
"-trusted_first use locally trusted certificates first when building trust chain\n");
BIO_printf(bio_err,
"-no_alt_chains only ever use the first certificate chain found\n");
BIO_printf(bio_err,
"-crl_check check revocation status of signer's certificate using CRLs\n");
BIO_printf(bio_err,

2
apps/ocsp.c
View File

@@ -537,6 +537,8 @@ int MAIN(int argc, char **argv)
"-CAfile file trusted certificates file\n");
BIO_printf(bio_err,
"-trusted_first use locally trusted CA's first when building trust chain\n");
BIO_printf(bio_err,
"-no_alt_chains only ever use the first certificate chain found\n");
BIO_printf(bio_err,
"-VAfile file validator certificates file\n");
BIO_printf(bio_err,

2
apps/s_client.c
View File

@@ -320,6 +320,8 @@ static void sc_usage(void)
BIO_printf(bio_err, " -CAfile arg - PEM format file of CA's\n");
BIO_printf(bio_err,
" -trusted_first - Use local CA's first when building trust chain\n");
BIO_printf(bio_err,
" -no_alt_chains - only ever use the first certificate chain found\n");
BIO_printf(bio_err,
" -reconnect - Drop and re-make the connection with the same Session-ID\n");
BIO_printf(bio_err,

2
apps/s_server.c
View File

@@ -508,6 +508,8 @@ static void sv_usage(void)
BIO_printf(bio_err, " -CAfile arg - PEM format file of CA's\n");
BIO_printf(bio_err,
" -trusted_first - Use locally trusted CA's first when building trust chain\n");
BIO_printf(bio_err,
" -no_alt_chains - only ever use the first certificate chain found\n");
BIO_printf(bio_err,
" -nocert - Don't use any certificates (Anon-DH)\n");
BIO_printf(bio_err,

2
apps/smime.c
View File

@@ -443,6 +443,8 @@ int MAIN(int argc, char **argv)
BIO_printf(bio_err, "-CAfile file trusted certificates file\n");
BIO_printf(bio_err,
"-trusted_first use locally trusted CA's first when building trust chain\n");
BIO_printf(bio_err,
"-no_alt_chains only ever use the first certificate chain found\n");
BIO_printf(bio_err,
"-crl_check check revocation status of signer's certificate using CRLs\n");
BIO_printf(bio_err,

2
apps/verify.c
View File

@@ -236,7 +236,7 @@ int MAIN(int argc, char **argv)
end:
if (ret == 1) {
BIO_printf(bio_err,
"usage: verify [-verbose] [-CApath path] [-CAfile file] [-trusted_first] [-purpose purpose] [-crl_check]");
"usage: verify [-verbose] [-CApath path] [-CAfile file] [-trusted_first] [-purpose purpose] [-crl_check] [-no_alt_chains]");
#ifndef OPENSSL_NO_ENGINE
BIO_printf(bio_err, " [-engine e]");
#endif