[openssl/openssl] fe99c1: SSL_OP_SECOP is dead code

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: fe99c122333d8c48e843b9820bd291669a713a33
      https://github.com/openssl/openssl/commit/fe99c122333d8c48e843b9820bd291669a713a33
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M apps/lib/s_cb.c
    M include/openssl/ssl.h.in
    M ssl/ssl_cert.c
    M ssl/ssl_local.h
    M ssl/ssl_rsa.c
    M ssl/statem/statem_lib.c
    M ssl/t1_lib.c

  Log Message:
  -----------
  SSL_OP_SECOP is dead code

Nothing set the "vfy" parameters in any of these functions to anything but 0.

Remove the parameter and stage things related to SSL_OP_SECOP to go away in the
future.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:54:54 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


  Commit: 6542facd6182b50ff68c6fb5817b03efa656f248
      https://github.com/openssl/openssl/commit/6542facd6182b50ff68c6fb5817b03efa656f248
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M ssl/t1_lib.c

  Log Message:
  -----------
  Don't attempt to check the security level on what signed our own certificate.

What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)

Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.

Fixes: https://github.com/openssl/openssl/issues/31195

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:54:55 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


Compare: https://github.com/openssl/openssl/compare/628ff07cfb64...6542facd6182

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/628ff0-6542fa%40github.com.