openssl
/
openssl
mirror of https://github.com/openssl/openssl
1
0
Fork 0
Code Issues Releases Wiki Activity

CMP app: make -ignore_keyusage apply also for mock server 

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19948)
This commit is contained in:
Dr. David von Oheimb 2022-12-19 11:09:33 +01:00 committed by Dr. David von Oheimb
parent 971028535e
commit fd514375e2
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
apps/cmp.c
View File

@ -1238,9 +1238,6 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
}
}
if (opt_ignore_keyusage)
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
if (opt_unprotected_errors)
(void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1);
@ -3244,6 +3241,9 @@ int cmp_main(int argc, char **argv)
}
#endif
if (opt_ignore_keyusage)
(void)OSSL_CMP_CTX_set_option(cmp_ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
if (opt_use_mock_srv
#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
|| opt_port != NULL

1
doc/man1/openssl-cmp.pod.in
View File

@ -632,6 +632,7 @@ For details see the description of the B<-subject> option.
Ignore key usage restrictions in CMP signer certificates when validating
signature-based protection of incoming CMP messages.
By default, C<digitalSignature> must be allowed by CMP signer certificates.
This option applies to both CMP clients and the mock server.
=item B<-unprotected_errors>