diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2009-10-23 14:06:35 +0200 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2009-10-23 14:06:35 +0200 |
| commit | 45cd59ac71d244ff562741fbaffb34dc18872f5e (patch) | |
| tree | 6d6eaa8355d8d5ac5696917a6b32cd6328371410 /crypto/x509 | |
| parent | Need to check <= 0 here. (diff) | |
| download | openssl-45cd59ac71d244ff562741fbaffb34dc18872f5e.tar.xz openssl-45cd59ac71d244ff562741fbaffb34dc18872f5e.zip | |
If not checking all certificates don't attempt to find a CRL
for the leaf certificate of a CRL path.
Diffstat (limited to 'crypto/x509')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index d1a15502a2..f5f632a45d 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -679,7 +679,12 @@ static int check_revocation(X509_STORE_CTX *ctx) if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) last = sk_X509_num(ctx->chain) - 1; else + { + /* If checking CRL paths this isn't the EE certificate */ + if (ctx->parent) + return 1; last = 0; + } for(i = 0; i <= last; i++) { ctx->error_depth = i; |