Commits on Jan 21, 2023

1. Ensure X509 extensions are hashed & cached, before deciding a cert is… …

   … CA or EE
   
   If X509_check_ca() fails to cache X509v3 extension values, the return
   value may be incorrect, leading to erroneously assuming a given certificate
   is a CA or EE cert (while in reality it is the other, or neither).
   
   This failure mode can arise because X509_check_ca() doesn't verify
   whether libcrypto's (void)x509v3_cache_extensions(x) flipped the EXFLAG_INVALID
   flag in x->ex_flags. Unfortunately, X509_check_ca() doesn't have a return code
   to indicate an error, so this can't be fixed in libcrypto - the API is broken.
   
   The workaround is to call X509_check_purpose(3) with a purpose argument of -1,
   before calling X509_check_ca(), this ensures the X509v3 extensions are cached.
   Since X509_check_purpose() does have a return code to indicate errors, we can
   use that to supplement X509_check_ca()'s shortcomings.
   
   OpenBSD's rpki-client also uses the above approach.

   

   job committed Jan 21, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 178cbd7
   • Browse repository at this point

   Copy the full SHA

   178cbd7 View commit details

   Browse the repository at this point in the history