[openssl-commits] [openssl] OpenSSL_1_0_2-stable update
Richard Levitte
levitte at openssl.org
Tue Sep 26 09:04:11 UTC 2017
The branch OpenSSL_1_0_2-stable has been updated
via ed0245e08fdf374cd6351a1ae8117d7382115a21 (commit)
from 859a42531acf2c3547711f642bcfd7fd52eb2338 (commit)
- Log -----------------------------------------------------------------
commit ed0245e08fdf374cd6351a1ae8117d7382115a21
Author: Richard Levitte <levitte at openssl.org>
Date: Tue Sep 26 10:45:05 2017 +0200
Make sure that a cert with extensions gets version number 2 (v3)
Fixes #4419
Reviewed-by: Tim Hudson <tjh at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4421)
-----------------------------------------------------------------------
Summary of changes:
apps/ca.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/apps/ca.c b/apps/ca.c
index f90f033..9a83996 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1985,10 +1985,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
/* Lets add the extensions, if there are any */
if (ext_sect) {
X509V3_CTX ctx;
- if (ci->version == NULL)
- if ((ci->version = ASN1_INTEGER_new()) == NULL)
- goto err;
- ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
/*
* Free the current entries if any, there should not be any I believe
@@ -2051,6 +2047,15 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
goto err;
}
+ {
+ STACK_OF(X509_EXTENSION) *exts = ci->extensions;
+
+ if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0)
+ /* Make it an X509 v3 certificate. */
+ if (!X509_set_version(ret, 2))
+ goto err;
+ }
+
/* Set the right value for the noemailDN option */
if (email_dn == 0) {
if (!X509_set_subject_name(ret, dn_subject))
More information about the openssl-commits
mailing list