Dr. David von Oheimb 0b670a2101 x509_vfy.c: Improve key usage checks in internal_verify() of cert chains ... If a presumably self-signed cert is last in chain we verify its signature only if X509_V_FLAG_CHECK_SS_SIGNATURE is set. Upon this request we do the signature verification, but not in case it is a (non-conforming) self-issued CA certificate with a key usage extension that does not include keyCertSign. Make clear when we must verify the signature of a certificate and when we must adhere to key usage restrictions of the 'issuing' cert. Add some comments for making internal_verify() easier to understand. Update the documentation of X509_V_FLAG_CHECK_SS_SIGNATURE accordingly. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12375)		2020-07-16 15:48:53 +02:00
..
build.info	Chunk 11 of CMP contribution to OpenSSL: CMP command-line interface	2020-05-13 19:42:00 +02:00
CA.pl.pod	There is no -signreq option in CA.pl	2020-05-21 13:28:14 +02:00
openssl-asn1parse.pod.in	Remove whitespace from 'white space'	2020-06-19 07:59:46 +02:00
openssl-ca.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-ciphers.pod.in	Add cipher list ciphersuites which using encryption algorithm in mode CBC.	2020-06-04 17:45:00 +03:00
openssl-cmds.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-cmp.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-cms.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-crl2pkcs7.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-crl.pod.in	Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c	2020-05-15 20:20:08 +02:00
openssl-dgst.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-dhparam.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-dsa.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-dsaparam.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-ec.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-ecparam.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-enc.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-engine.pod.in	engine: document the engine app as deprecated	2020-07-16 09:12:26 +02:00
openssl-errstr.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-fipsinstall.pod.in	Make -provider_name and -section_name optional	2020-07-15 23:17:29 +02:00
openssl-gendsa.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-genpkey.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-genrsa.pod.in	Update RSA keygen to use sp800-56b by default	2020-06-10 08:59:56 +10:00
openssl-info.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-kdf.pod.in	Revert "kdf: make function naming consistent."	2020-07-16 14:21:07 +02:00
openssl-list.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-mac.pod.in	Revert "The EVP_MAC functions have been renamed for consistency. The EVP_MAC_CTX_*"	2020-07-16 14:21:07 +02:00
openssl-nseq.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-ocsp.pod.in	Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c	2020-05-15 20:20:08 +02:00
openssl-passwd.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-pkcs7.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-pkcs8.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-pkcs12.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-pkey.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-pkeyparam.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-pkeyutl.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-prime.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-provider.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-rand.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-rehash.pod.in	Amend references to "OpenSSL license"	2020-04-29 15:27:22 +02:00
openssl-req.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-rsa.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-rsautl.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-s_client.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-s_server.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-s_time.pod.in	Fix typos and repeated words	2020-07-05 01:49:20 +02:00
openssl-sess_id.pod.in	Fix typos and repeated words	2020-07-05 01:49:20 +02:00
openssl-smime.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-speed.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-spkac.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-srp.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-storeutl.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-ts.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-verify.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl-version.pod.in	Update copyright year	2020-04-23 13:55:52 +01:00
openssl-x509.pod.in	apps: document the deprecation of the -engine option	2020-07-16 09:12:27 +02:00
openssl.pod	x509_vfy.c: Improve key usage checks in internal_verify() of cert chains	2020-07-16 15:48:53 +02:00
tsget.pod	Update copyright year	2020-04-23 13:55:52 +01:00