github/open62541
7
0
Fork 0
mirror of https://github.com/open62541/open62541.git synced 2025-06-03 04:00:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(plugins): Remove comparison of authorityKeyIdentifier / subjectKeyIdentifier not supported by CTT

Browse Source 
The CTT example Security User X509/001.js expects that an issuer is
selected where the authorityKeyIdentifier / subjectKeyIdentifier do not
match. No longer use X509_check_issued, but rather manually check if the
issuer name and subject name match -- with no other checks beyond that.
This commit is contained in:
Julius Pfrommer 2024-11-25 16:54:03 +01:00 committed by Julius Pfrommer
parent 06f3e3d430
commit 9e59f1abe2
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
plugins/crypto/openssl/ua_pki_openssl.c
View File

@ -462,6 +462,7 @@ static X509 *
openSSLFindNextIssuer(CertContext *ctx, STACK_OF(X509) *stack, X509 *x509, X509 *prev) {
/* First check issuers from the stack - provided in the same bytestring as
* the certificate. This can also return x509 itself. */
X509_NAME *in = X509_get_issuer_name(x509);
do {
int size = sk_X509_num(stack);
for(int i = 0; i < size; i++) {
@ -474,7 +475,7 @@ openSSLFindNextIssuer(CertContext *ctx, STACK_OF(X509) *stack, X509 *x509, X509
/* This checks subject/issuer name and the key usage of the issuer.
* It does not verify the validity period and if the issuer key was
* used for the signature. We check that afterwards. */
if(X509_check_issued(candidate, x509) == 0)
if(X509_NAME_cmp(in, X509_get_subject_name(candidate)) == 0)
return candidate;
}
/* Switch from the stack that came with the cert to the issuer list and