diff options
| author | Michael Brown | 2020-12-08 15:58:46 +0100 |
|---|---|---|
| committer | Michael Brown | 2020-12-08 16:04:28 +0100 |
| commit | 39f5293492f351a274940d0ba2624ecb242b3c9b (patch) | |
| tree | ead79747a5ab15d5db6dd4a236acdc9f224c7590 /src/crypto/ocsp.c | |
| parent | [ocsp] Remove dummy OCSP certificate root (diff) | |
| download | ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.tar.gz ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.tar.xz ipxe-39f5293492f351a274940d0ba2624ecb242b3c9b.zip | |
[x509] Record root of trust used when validating a certificate
Record the root of trust used at the point that a certificate is
validated, redefine validation as checking a certificate against a
specific root of trust, and pass an explicit root of trust when
creating a TLS connection.
This allows a custom TLS connection to be used with a custom root of
trust, without causing any validated certificates to be treated as
valid for normal purposes.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/crypto/ocsp.c')
| -rw-r--r-- | src/crypto/ocsp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index 998a0ce2c..cc957b40c 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -284,7 +284,7 @@ int ocsp_check ( struct x509_certificate *cert, /* Sanity checks */ assert ( cert != NULL ); assert ( issuer != NULL ); - assert ( x509_is_valid ( issuer ) ); + assert ( issuer->root != NULL ); /* Allocate and initialise check */ *ocsp = zalloc ( sizeof ( **ocsp ) ); @@ -915,7 +915,7 @@ int ocsp_validate ( struct ocsp_check *ocsp, time_t time ) { */ x509_invalidate ( signer ); if ( ( rc = x509_validate ( signer, ocsp->issuer, time, - NULL ) ) != 0 ) { + ocsp->issuer->root ) ) != 0 ) { DBGC ( ocsp, "OCSP %p \"%s\" could not validate ", ocsp, x509_name ( ocsp->cert ) ); DBGC ( ocsp, "signer \"%s\": %s\n", @@ -961,7 +961,7 @@ int ocsp_validate ( struct ocsp_check *ocsp, time_t time ) { /* Validate certificate against issuer */ if ( ( rc = x509_validate ( ocsp->cert, ocsp->issuer, time, - NULL ) ) != 0 ) { + ocsp->issuer->root ) ) != 0 ) { DBGC ( ocsp, "OCSP %p \"%s\" could not validate certificate: " "%s\n", ocsp, x509_name ( ocsp->cert ), strerror ( rc )); return rc; |