[openssl/openssl] c25e1c: SSL_OP_SECOP is dead code

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: c25e1c4b78a8c3186eb2df52232a1995fee7814e
      https://github.com/openssl/openssl/commit/c25e1c4b78a8c3186eb2df52232a1995fee7814e
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M apps/lib/s_cb.c
    M include/openssl/ssl.h.in
    M ssl/ssl_cert.c
    M ssl/ssl_local.h
    M ssl/ssl_rsa.c
    M ssl/statem/statem_lib.c
    M ssl/t1_lib.c

  Log Message:
  -----------
  SSL_OP_SECOP is dead code

Nothing set the "vfy" parameters in any of these functions to anything but 0.

Remove the parameter and stage things related to SSL_OP_SECOP to go away in the
future.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:47:07 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


  Commit: 5a55913f10e9fe8686c82778810aa6b7d5335e4d
      https://github.com/openssl/openssl/commit/5a55913f10e9fe8686c82778810aa6b7d5335e4d
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M ssl/t1_lib.c

  Log Message:
  -----------
  Don't attempt to check the security level on what signed our own certificate.

What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)

Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.

Fixes: https://github.com/openssl/openssl/issues/31195

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:47:09 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


Compare: https://github.com/openssl/openssl/compare/bca4e465685a...5a55913f10e9

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/bca4e4-5a5591%40github.com.