generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

For self signed root only indicate one error.

Browse Source
This commit is contained in:
Dr. Stephen Henson 2014-03-03 23:33:51 +00:00
parent 12c56e4888
commit bdfc0e284c
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/x509/x509_vfy.c
View File

@ -366,8 +366,11 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
/* If explicitly rejected error */ /* If explicitly rejected error */
if (i == X509_TRUST_REJECTED) if (i == X509_TRUST_REJECTED)
goto end; goto end;
/* If not explicitly trusted then indicate error */ /* If not explicitly trusted then indicate error unless it's
if (i != X509_TRUST_TRUSTED) * a single self signed certificate in which case we've indicated
* an error already and set bad_chain == 1
*/
if (i != X509_TRUST_TRUSTED && !bad_chain)
{ {
if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss)) if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss))
{ {