diff options
| -rw-r--r-- | crypto/x509/x509_trs.c | 2 | ||||
| -rw-r--r-- | include/openssl/x509.h | 5 |
2 files changed, 4 insertions, 3 deletions
diff --git a/crypto/x509/x509_trs.c b/crypto/x509/x509_trs.c index 72c8110313..7392c55953 100644 --- a/crypto/x509/x509_trs.c +++ b/crypto/x509/x509_trs.c @@ -285,7 +285,7 @@ static int trust_compat(X509_TRUST *trust, X509 *x, int flags) { /* Call for side-effect of computing hash and caching extensions */ X509_check_purpose(x, -1, 0); - if (x->ex_flags & EXFLAG_SS) + if ((flags & X509_TRUST_NO_SS_COMPAT) == 0 && x->ex_flags & EXFLAG_SS) return X509_TRUST_TRUSTED; else return X509_TRUST_UNTRUSTED; diff --git a/include/openssl/x509.h b/include/openssl/x509.h index 477bff8eb8..7581bb4be8 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h @@ -199,8 +199,9 @@ DEFINE_STACK_OF(X509_TRUST) # define X509_TRUST_MAX 8 /* trust_flags values */ -# define X509_TRUST_DYNAMIC 1 -# define X509_TRUST_DYNAMIC_NAME 2 +# define X509_TRUST_DYNAMIC (1U << 0) +# define X509_TRUST_DYNAMIC_NAME (1U << 1) +# define X509_TRUST_NO_SS_COMPAT (1U << 2) /* check_trust return codes */ |