Hi Viktor,
Thank you for the response.
This is the code snippet from OpenSSL 1.0.2d.
int X509_verify_cert(X509_STORE_CTX *ctx) {
....................
....................
....................
/* we now have our chain, lets check it... */
i = check_trust(ctx);
/* If explicitly rejected error */
if (i == X509_TRUST_REJECTED)
goto end;
}
This is code snippet from OpenSSL 1.0.1c
int X509_verify_cert(X509_STORE_CTX *ctx) {
....................
....................
....................
/* The chain extensions are OK: check trust */
*if (param->trust > 0)* ok = check_trust(ctx);
}
I am talking about "*if (param->trust > 0)" *that seems to removed in
OpenSSL 1.0.2d.
Regards
Jayalakshmi
On Mon, Nov 16, 2015 at 1:26 AM, Viktor Dukhovni <openssl-us...@dukhovni.org
> wrote:
> On Sun, Nov 15, 2015 at 07:00:06PM +0530, Jayalakshmi bhat wrote:
>
> > In earlier version of OpenSSL (i.e OpenSSL 1.0.1c) X509_verify_cert
> had a
> > check * if (params->trust >0)* before invoking check_trust function.
>
> The OpenSSL source code is available via git:
>
> https://github.com/openssl/openssl.git
>
> The branch containing 1.0.2c and 1.0.2d is "OpenSSL_1_0_2-stable".
>
> Can you point to the commit that makes the change in question?
>
> > This has been removed in OpenSSL 1.0.2d. Does it mean applications are
> > expected to set the X509_VERIFY_PARAM properly?
>
> I don't see any changes that match your description.
>
> --
> Viktor.
> _______________________________________________
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
