diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2009-06-15 17:01:00 +0200 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2009-06-15 17:01:00 +0200 |
| commit | 31db43df0859210a32af3708df08f0149c46ede0 (patch) | |
| tree | 3287605ec579c747e3444a1a5aad43e3a3e8209c /crypto/x509/x509_vfy.c | |
| parent | Fix error codes. (diff) | |
| download | openssl-31db43df0859210a32af3708df08f0149c46ede0.tar.xz openssl-31db43df0859210a32af3708df08f0149c46ede0.zip | |
Update from 0.9.8-stable.
Diffstat (limited to 'crypto/x509/x509_vfy.c')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 9ff66cff13..dd4065b0ce 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1609,7 +1609,11 @@ static int internal_verify(X509_STORE_CTX *ctx) while (n >= 0) { ctx->error_depth=n; - if (!xs->valid) + + /* Skip signature check for self signed certificates. It + * doesn't add any security and just wastes time. + */ + if (!xs->valid && xs != xi) { if ((pkey=X509_get_pubkey(xi)) == NULL) { @@ -1619,13 +1623,6 @@ static int internal_verify(X509_STORE_CTX *ctx) if (!ok) goto end; } else if (X509_verify(xs,pkey) <= 0) - /* XXX For the final trusted self-signed cert, - * this is a waste of time. That check should - * optional so that e.g. 'openssl x509' can be - * used to detect invalid self-signatures, but - * we don't verify again and again in SSL - * handshakes and the like once the cert has - * been declared trusted. */ { ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE; ctx->current_cert=xs; |