[openssl/openssl] ebb1c1: Skip partial-chain trust anchors in revocation checks
"'Mounir IDRASSI' via openssl-commits" <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/master/[email protected]> |
Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: ebb1c1a509b1cd5e375f55f0ab183a8adb421869
https://github.com/openssl/openssl/commit/ebb1c1a509b1cd5e375f55f0ab183a8adb421869
Author: Mounir IDRASSI <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M crypto/x509/x509_vfy.c
M test/recipes/25-test_verify.t
Log Message:
-----------
Skip partial-chain trust anchors in revocation checks
When a non-self-signed certificate is accepted as the trust anchor via
X509_V_FLAG_PARTIAL_CHAIN, revocation checking should stop before that
certificate.
Use ctx->num_untrusted as the boundary for CRL_CHECK_ALL and
OCSP_RESP_CHECK_ALL in partial-chain verification, and cover the
PARTIAL_CHAIN CRL_CHECK_ALL case with a focused regression test.
Reviewed-by: David von Oheimb <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 15:44:18 2026
(Merged from https://github.com/openssl/openssl/pull/30945)
Commit: 4be37de061f5f6dee743fc5f55d832a1178405ca
https://github.com/openssl/openssl/commit/4be37de061f5f6dee743fc5f55d832a1178405ca
Author: Mounir IDRASSI <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M crypto/x509/x509_vfy.c
Log Message:
-----------
Tighten CRL issuer matching
Require a candidate CRL issuer certificate subject to match the CRL
issuer name before accepting an AKID match. This avoids accepting the
truncated chain anchor as a CRL issuer solely because the CRL has no
AKID.
Reviewed-by: David von Oheimb <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 15:44:24 2026
(Merged from https://github.com/openssl/openssl/pull/30945)
Compare: https://github.com/openssl/openssl/compare/90eb7db52702...4be37de061f5
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/90eb7d-4be37d%40github.com.