When auxiliary data contains only reject entries, continue to trust
self-signed objects just as when no auxiliary data is present.
This makes it possible to reject specific uses without changing
what's accepted (and thus overring the underlying EKU).
Added new supported certs and doubled test count from 38 to 76.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
This includes basic constraints, key usages, issuer EKUs and auxiliary
trust OIDs (given a trust suitably related to the intended purpose).
Added tests and updated documentation.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
These can be re-generated via:
cd test/certs; ./setup.sh
if need be. The keys are all RSA 2048-bit keys, but it is possible
to change that via environment variables.
cd test/certs
rm -f *-key.pem *-key2.pem
OPENSSL_KEYALG=rsa OPENSSL_KEYBITS=3072 ./setup.sh
cd test/certs
rm -f *-key.pem *-key2.pem
OPENSSL_KEYALG=ecdsa OPENSSL_KEYBITS=secp384r1 ./setup.sh
...
Keys are re-used if already present, so the environment variables
are only used when generating any keys that are missing. Hence
the "rm -f"
Reviewed-by: Richard Levitte <levitte@openssl.org>
This adds a test for CVE-2015-1793. This adds a new test file
verify_extra_test.c, which could form the basis for additional
verification tests.
Reviewed-by: Stephen Henson <steve@openssl.org>
