CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/07 02:55:48
Modified files:
lib/libcrypto/x509: x509_purp.c
Log message:
Reject certificates that are not v3
X509 v1 is bloody ancient. we continue to have nasty things lurking
as corner cases to support it when there is really no need to.
Sadly, it has been kept around for ages for "roots" because of people
with old tests and nonsense that were generated for v1. v3 is required
by any modern certs.
Rather than supporting "tests" that aren't really testing what the real
world uses, stop the madness.
x509v3_cache_extensions marks any certificate whose version is not v3
invalid, so v1 and v2 certificates fail verification and purpose checks.
This may break tests suites generated with old junk. (we had one in
tree that I fixed before this).
We will see if this change is too painful to support in ports right now.
If we can keep this, more code removal follows.
ok tb@
