diff options
author | Matt Caswell <matt@openssl.org> | 2015-01-27 10:35:27 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-02-25 09:14:54 +0000 |
commit | 15dba5be6a4482a9ad7e5b846291f31e97e338ca (patch) | |
tree | 253ce0595f341783c672b4fd2771d6528fd55337 /crypto/x509/x509_vfy.h | |
parent | da084a5ec6cebd67ae27f2463ebe4a50bb840fa5 (diff) | |
download | openssl-15dba5be6a4482a9ad7e5b846291f31e97e338ca.tar.gz |
Add flag to inhibit checking for alternate certificate chains. Setting this
behaviour will force behaviour as per previous versions of OpenSSL
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Diffstat (limited to 'crypto/x509/x509_vfy.h')
-rw-r--r-- | crypto/x509/x509_vfy.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h index 03e43e5869..e41b5e228b 100644 --- a/crypto/x509/x509_vfy.h +++ b/crypto/x509/x509_vfy.h @@ -419,6 +419,12 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); # define X509_V_FLAG_SUITEB_128_LOS 0x30000 /* Allow partial chains if at least one certificate is in trusted store */ # define X509_V_FLAG_PARTIAL_CHAIN 0x80000 +/* + * If the initial chain is not trusted, do not attempt to build an alternative + * chain. Alternate chain checking was introduced in 1.1.0. Setting this flag + * will force the behaviour to match that of previous versions. + */ +# define X509_V_FLAG_NO_ALT_CHAINS 0x100000 # define X509_VP_FLAG_DEFAULT 0x1 # define X509_VP_FLAG_OVERWRITE 0x2 |