diff options
| author | Richard Levitte <levitte@openssl.org> | 2019-01-16 21:54:48 +0100 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2019-01-16 21:59:03 +0100 |
| commit | 9b10986d7742a5105ac8c5f4eba8b103caf57ae9 (patch) | |
| tree | 993010b0eecab8e1c2e9cfd23c97158ac19dc98c /apps/verify.c | |
| parent | crypto/bio/b_dump.c: change all char* to void*, and constify (diff) | |
| download | openssl-9b10986d7742a5105ac8c5f4eba8b103caf57ae9.tar.xz openssl-9b10986d7742a5105ac8c5f4eba8b103caf57ae9.zip | |
apps/verify.c: Change an old comment to clarify what the callback does
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/7922)
Diffstat (limited to 'apps/verify.c')
| -rw-r--r-- | apps/verify.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/apps/verify.c b/apps/verify.c index 3768feda81..2f66912cdc 100644 --- a/apps/verify.c +++ b/apps/verify.c @@ -286,16 +286,19 @@ static int cb(int ok, X509_STORE_CTX *ctx) cert_error, X509_STORE_CTX_get_error_depth(ctx), X509_verify_cert_error_string(cert_error)); + + /* + * Pretend that some errors are ok, so they don't stop further + * processing of the certificate chain. Setting ok = 1 does this. + * After X509_verify_cert() is done, we verify that there were + * no actual errors, even if the returned value was positive. + */ switch (cert_error) { case X509_V_ERR_NO_EXPLICIT_POLICY: policies_print(ctx); /* fall thru */ case X509_V_ERR_CERT_HAS_EXPIRED: - - /* - * since we are just checking the certificates, it is ok if they - * are self signed. But we should still warn the user. - */ + /* Continue even if the leaf is a self signed cert */ case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: /* Continue after extension errors too */ case X509_V_ERR_INVALID_CA: |