Not sure about how to completely solve the problem. As the
function
X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx)
is called, crit is not actually used.
(e.g., in v3_purp.c, line 462)
x->akid =X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);
If the value of crit can be retrieved, we may fix
function X509_check_issued (around line 701).
if(X509_NAME_cmp(X509_get_subject_name(issuer),
X509_get_issuer_name(subject)))
return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
x509v3_cache_extensions(issuer);
x509v3_cache_extensions(subject);
if(subject->akid)
{
int ret = X509_check_akid(issuer, subject->akid);
if (ret != X509_V_OK)
return ret;
}
+ else if (crit==-2) //subject has more than one akids
+ return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
