diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2012-01-26 14:57:45 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2012-01-26 14:57:45 +0000 |
| commit | 7568d15acddd07e8da0c436e84c0f5c4c015e325 (patch) | |
| tree | 26611e28bf7c0c1c8fed54b25bdf8e2775e9680b /crypto/x509v3 | |
| parent | 08e4ea4884bc0ee9688255771bc7398cd2ccd394 (diff) | |
| download | openssl-7568d15acddd07e8da0c436e84c0f5c4c015e325.tar.gz | |
allow key agreement for SSL/TLS certificates
Diffstat (limited to 'crypto/x509v3')
| -rw-r--r-- | crypto/x509v3/v3_purp.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c index e7cf701160..4b986dfc5d 100644 --- a/crypto/x509v3/v3_purp.c +++ b/crypto/x509v3/v3_purp.c @@ -562,12 +562,18 @@ static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int c { if(xku_reject(x,XKU_SSL_CLIENT)) return 0; if(ca) return check_ssl_ca(x); - /* We need to do digital signatures with it */ - if(ku_reject(x,KU_DIGITAL_SIGNATURE)) return 0; + /* We need to do digital signatures or key agreement */ + if(ku_reject(x,KU_DIGITAL_SIGNATURE|KU_KEY_AGREEMENT)) return 0; /* nsCertType if present should allow SSL client use */ if(ns_reject(x, NS_SSL_CLIENT)) return 0; return 1; } +/* Key usage needed for TLS/SSL server: digital signature, encipherment or + * key agreement. The ssl code can check this more thoroughly for individual + * key types. + */ +#define KU_TLS \ + KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT|KU_KEY_AGREEMENT static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca) { @@ -575,8 +581,7 @@ static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int c if(ca) return check_ssl_ca(x); if(ns_reject(x, NS_SSL_SERVER)) return 0; - /* Now as for keyUsage: we'll at least need to sign OR encipher */ - if(ku_reject(x, KU_DIGITAL_SIGNATURE|KU_KEY_ENCIPHERMENT)) return 0; + if(ku_reject(x, KU_TLS)) return 0; return 1; |