[openssl/openssl] 04a1fc: SSL_OP_SECOP is dead code

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 04a1fc500f0199336517713d7d7019cac5885883
      https://github.com/openssl/openssl/commit/04a1fc500f0199336517713d7d7019cac5885883
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M apps/lib/s_cb.c
    M include/openssl/ssl.h.in
    M ssl/ssl_cert.c
    M ssl/ssl_local.h
    M ssl/ssl_rsa.c
    M ssl/statem/statem_lib.c
    M ssl/t1_lib.c

  Log Message:
  -----------
  SSL_OP_SECOP is dead code

Nothing set the "vfy" parameters in any of these functions to anything but 0.

Remove the parameter and stage things related to SSL_OP_SECOP to go away in the
future.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:55:31 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


  Commit: 1609edf2edbf91ddd1f027458c8ff52d44a24dde
      https://github.com/openssl/openssl/commit/1609edf2edbf91ddd1f027458c8ff52d44a24dde
  Author: Bob Beck <[email protected]>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M ssl/t1_lib.c

  Log Message:
  -----------
  Don't attempt to check the security level on what signed our own certificate.

What matters to us is that the key *we* are using matches our desired
security level, as we may sign things with that key. As far as who
signed us, this could be signed by something we don't recognize at all,
and it is up to the peer to decide if the thing signing us matters to
it (i.e. if it recognizes the algorithm, decides it's strong enough,
or it even verifies the signature, as it might already trusts our key
due to pinning, TOFU, Prayer and Clean Living, or whatever.)

Obviously, we still check the security level on any signatures *we*
recieve to verify *from* a peer.

Fixes: https://github.com/openssl/openssl/issues/31195

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Tue Jun 30 10:55:32 2026
(Merged from https://github.com/openssl/openssl/pull/31271)


Compare: https://github.com/openssl/openssl/compare/e7a956c3643b...1609edf2edbf

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/e7a956-1609ed%40github.com.