 Viktor Dukhovni
|
5ae4ceb92c
Perform DANE-EE(3) name checks by default
|
8 years ago |
 Dr. Stephen Henson
|
5bd5dcd496
Add nameConstraints commonName checking.
|
8 years ago |
 Richard Levitte
|
8e21938ce3
Remove the envvar hack to enable proxy cert processing
|
8 years ago |
 FdaSilvaYY
|
02e112a885
Whitespace cleanup in crypto
|
8 years ago |
|
Richard Levitte
|
ed17c7c146
Fix proxy certificate pathlength verification
|
8 years ago |
|
Richard Levitte
|
c8223538cb
Check that the subject name in a proxy cert complies to RFC 3820
|
8 years ago |
|
Viktor Dukhovni
|
f3e235ed6f
Ensure verify error is set when X509_verify_cert() fails
|
8 years ago |
 Rich Salz
|
6ddbb4cd92
X509_STORE_CTX accessors.
|
8 years ago |
|
Rich Salz
|
b1322259d9
Copyright consolidation 09/10
|
8 years ago |
|
FdaSilvaYY
|
dccd20d1b5
fix tab-space mixed indentation
|
8 years ago |
|
Viktor Dukhovni
|
7b7eb4725e
Drop duplicate ctx->verify_cb assignment
|
8 years ago |
|
Viktor Dukhovni
|
c965487373
Implement X509_STORE_CTX_set_current_cert() accessor
|
8 years ago |
|
Viktor Dukhovni
|
69664d6af0
Future proof build_chain() in x509_vfy.c
|
8 years ago |
|
Viktor Dukhovni
|
51227177b1
Added missing X509_STORE_CTX_set_error_depth() accessor
|
8 years ago |
|
Rich Salz
|
9021a5dfb3
Rename some lowercase API's
|
8 years ago |
|
Dr. Stephen Henson
|
4dba585f79
Add X509_STORE_CTX_set0_untrusted function.
|
8 years ago |
|
Rich Salz
|
f0e0fd51fd
Make many X509_xxx types opaque.
|
8 years ago |
|
Rich Salz
|
b9aec69ace
Add SSL_DANE typedef for consistency.
|
8 years ago |
|
Viktor Dukhovni
|
fbb82a60dc
Move peer chain security checks into x509_vfy.c
|
8 years ago |
|
Viktor Dukhovni
|
70dd3c6593
Tidy up x509_vfy callback handling
|
8 years ago |
|
Viktor Dukhovni
|
4d9e33acb2
Require intermediate CAs to have basicConstraints CA:true.
|
8 years ago |
|
Viktor Dukhovni
|
89ff989d01
Add a comment on dane_verify() logic
|
8 years ago |
 Alessandro Ghedini
|
c001ce3313
Convert CRYPTO_LOCK_X509_* to new multi-threading API
|
8 years ago |
|
Viktor Dukhovni
|
d33def6624
Deprecate the -issuer_checks debugging option
|
8 years ago |
|
Viktor Dukhovni
|
c0a445a9f2
Suppress DANE TLSA reflection when verification fails
|
8 years ago |
|
FdaSilvaYY
|
0d4fb84390
GH601: Various spelling fixes.
|
8 years ago |
|
Viktor Dukhovni
|
3921ded79a
Ensure correct chain depth for policy checks with DANE bare key TA
|
8 years ago |
|
Viktor Dukhovni
|
895c2f84a6
Long overdue cleanup of X509 policy tree verification
|
8 years ago |
|
Viktor Dukhovni
|
33cc5dde47
Compat self-signed trust with reject-only aux data
|
8 years ago |
|
Viktor Dukhovni
|
0daccd4dc1
Check chain extensions also for trusted certificates
|
8 years ago |
