Viktor Dukhovni
3342dcea7a
Reject when explicit trust EKU are set and none match. ...
Returning untrusted is enough for for full chains that end in
self-signed roots, because when explicit trust is specified it
suppresses the default blanket trust of self-signed objects.
But for partial chains, this is not enough, because absent a similar
trust-self-signed policy, non matching EKUs are indistinguishable
from lack of EKU constraints.
Therefore, failure to match any trusted purpose must trigger an
explicit reject.
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-20 19:03:36 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 18:43:38 +01:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 03:24:59 +00:00
2016-01-20 09:09:14 -05:00
2016-01-19 15:33:45 +00:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2015-12-07 12:06:06 +01:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 09:09:14 -05:00
2016-01-20 19:03:36 -05:00
2016-01-20 09:09:14 -05:00
2011-08-12 12:28:52 +00:00
2015-01-23 15:38:41 +01:00
2015-01-22 09:20:09 +00:00
2015-04-20 15:06:22 +02:00
2015-09-25 13:34:02 +02:00
2014-05-04 16:38:32 +02:00
2015-12-16 16:14:49 -05:00
2015-09-29 21:59:19 -04:00
2016-01-12 16:26:56 -05:00
2015-11-15 00:02:57 -05:00
2015-04-04 17:05:49 +02:00
2016-01-07 18:00:51 +00:00
2015-01-22 09:20:09 +00:00
2015-01-22 09:20:09 +00:00
2015-05-13 15:08:10 +01:00
2016-01-07 18:00:51 +00:00
2015-01-22 09:20:09 +00:00
2015-05-05 22:18:59 -04:00
2015-05-05 22:18:59 -04:00
2015-01-22 09:20:09 +00:00
2015-05-05 22:18:59 -04:00
2015-01-22 09:20:09 +00:00
2016-01-20 09:09:14 -05:00
2015-12-18 13:08:40 +01:00
2016-01-11 20:30:37 +01:00
2016-01-09 19:13:15 -05:00
2016-01-11 02:41:16 +00:00
2015-12-18 13:08:40 +01:00
2015-12-18 13:08:40 +01:00
2015-05-14 17:21:40 +02:00
2015-02-02 11:08:16 -05:00
2015-12-18 13:08:40 +01:00
2015-12-18 13:08:40 +01:00
2016-01-13 12:37:48 -05:00
2013-06-18 10:37:00 +02:00
2015-12-14 16:08:49 +01:00
2015-12-14 16:08:49 +01:00
2015-12-14 16:09:25 +01:00
2015-01-22 09:20:09 +00:00
2015-01-22 09:20:09 +00:00
2015-07-14 01:10:01 +02:00
2015-12-02 10:53:33 +01:00
2016-01-07 20:53:18 -05:00
2015-01-22 09:20:09 +00:00
2015-01-22 09:20:09 +00:00
2014-02-14 17:24:12 +01:00
2014-08-09 08:02:20 -04:00
3342dcea7a