mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-15 06:01:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
abdf35158e
openssl/test/certs/root-expired.pem

20 lines
1.1 KiB
Plaintext
Raw Normal View History

x509_vfy.c: Restore rejection of expired trusted (root) certificate The certificate path validation procedure specified in RFC 5280 does not include checking the validity period of the trusted (root) certificate. Still it is common good practice to perform this check. Also OpenSSL did this until commit 0e7b1383e, which accidentally killed it. The current commit restores the previous behavior. It also removes the cause of that bug, namely counter-intuitive design of the internal function check_issued(), which was complicated by checks that actually belong to some other internal function, namely find_issuer(). Moreover, this commit adds a regression check and proper documentation of the root cert validity period check feature, which had been missing so far. Fixes #13427 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13590)
2020-12-01 21:22:16 +08:00
-----BEGIN CERTIFICATE-----
make various test CA certs RFC 5280 compliant w.r.t. X509 extensions Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13719)
2020-12-13 04:36:06 +08:00
MIIC/zCCAeegAwIBAgIBATANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
IENBMB4XDTIwMTIxMjIwMTcwNFoXDTIwMTIxMTIwMTcwNFowEjEQMA4GA1UEAwwH
x509_vfy.c: Restore rejection of expired trusted (root) certificate The certificate path validation procedure specified in RFC 5280 does not include checking the validity period of the trusted (root) certificate. Still it is common good practice to perform this check. Also OpenSSL did this until commit 0e7b1383e, which accidentally killed it. The current commit restores the previous behavior. It also removes the cause of that bug, namely counter-intuitive design of the internal function check_issued(), which was complicated by checks that actually belong to some other internal function, namely find_issuer(). Moreover, this commit adds a regression check and proper documentation of the root cert validity period check feature, which had been missing so far. Fixes #13427 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13590)
2020-12-01 21:22:16 +08:00
Um9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHmAPUGvKBG
OHkPPx5xGRNtAt8rm3Zr/KywIe3WkQhCO6VjNexSW6CiSsXWAJQDl1o9uWco0n3j
IVyk7cY8jY6E0Z1Uwz3ZdKKWdmdx+cYaUHez/XjuW+DjjIkjwpoi7D7UN54HzcAr
VREXOjRCHGkNOhiw7RWUXsb9nofGHOeUGpLAXwXBc0PlA94JkckkztiOi34u4DFI
0YYqalUmeugLNk6XseCkydpcaUsDgAhWg6Mfsiq4wUz+xbFN1MABqu2+ziW97mmt
9gfNbiuhiVT1aOuYCe3JYGbLM2JKA7Bo1g6rX8E1VX79Ru6669y2oqPthX9337Vo
make various test CA certs RFC 5280 compliant w.r.t. X509 extensions Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13719)
2020-12-13 04:36:06 +08:00
IkN+ZiQjr8UCAwEAAaNgMF4wDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYw
HQYDVR0OBBYEFI71Ja8em2uEPXyAmslTnE1y96NSMB8GA1UdIwQYMBaAFI71Ja8e
m2uEPXyAmslTnE1y96NSMA0GCSqGSIb3DQEBCwUAA4IBAQC2j5q0uIsZeCXAT/ak
3zsJMsdeUK62XrctfDqGc71v+m09T+euPCpcpGkTVoO5ePijKcrlmbRQo5UZC/dM
6P1L75PqkUyoD3f9Ge3qYO0e+MSyfzTRJR14O46vaNsv8EoyNUfLcw0hgq9beK8z
34c/YA9vbaD18zdTlGR9L4VDIjeitkrwC16TCncuPfJiN6FbFyiYZLavOowTcEOW
gcIh5fH+Fluz+9+1iZHTD1/6xEblU6h2Q1KUrbQgNPKxnEzLcC0KKEtihNmHYA9x
RgddXkv2jsCnXZ7mK5mQgxegTedsucqcFF5RB43F5LYCiM6X2Kak468rqTbToM6T
dRIt
x509_vfy.c: Restore rejection of expired trusted (root) certificate The certificate path validation procedure specified in RFC 5280 does not include checking the validity period of the trusted (root) certificate. Still it is common good practice to perform this check. Also OpenSSL did this until commit 0e7b1383e, which accidentally killed it. The current commit restores the previous behavior. It also removes the cause of that bug, namely counter-intuitive design of the internal function check_issued(), which was complicated by checks that actually belong to some other internal function, namely find_issuer(). Moreover, this commit adds a regression check and proper documentation of the root cert validity period check feature, which had been missing so far. Fixes #13427 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13590)
2020-12-01 21:22:16 +08:00
-----END CERTIFICATE-----
Reference in New Issue Copy Permalink