apps/pkcs12.c: Add -untrusted option and improve option documentation#12643
Closed
DDvO wants to merge 2 commits intoopenssl:masterfrom
Closed
apps/pkcs12.c: Add -untrusted option and improve option documentation#12643DDvO wants to merge 2 commits intoopenssl:masterfrom
DDvO wants to merge 2 commits intoopenssl:masterfrom
Conversation
2 tasks
FdaSilvaYY
reviewed
Aug 15, 2020
DDvO
force-pushed
the
add_pkcs12_passcert_untrusted
branch
from
a1dcb6c to
1f5b057
Compare
DDvO
changed the title
DDvO
force-pushed
the
add_pkcs12_passcert_untrusted
branch
from
1f5b057 to
aa0594d
Compare
slontis
reviewed
Aug 19, 2020
DDvO
force-pushed
the
add_pkcs12_passcert_untrusted
branch
from
aa0594d to
60672e2
Compare
Contributor
Author
|
Thanks @FdaSilvaYY and @t8m for your comments. |
DDvO
force-pushed
the
add_pkcs12_passcert_untrusted
branch
from
60672e2 to
ee763c1
Compare
Contributor
Author
|
Rebased in order to solve merge conflicts. |
Also improve EE cert selection, user guidance, and documentation.
DDvO
force-pushed
the
add_pkcs12_passcert_untrusted
branch
from
ee763c1 to
1683af8
Compare
Contributor
Author
Thanks @t8m for pointing these out; I've meanwhile handled them. |
t8m
added
approval: done
openssl-machine
removed
the
approval: done
Collaborator
|
This pull request is ready to merge |
openssl-machine
added
the
approval: ready to merge
openssl-machine
pushed a commit
that referenced
this pull request
Aug 27, 2020
Reviewed-by: Tomas Mraz <[email protected]> (Merged from #12643)
openssl-machine
pushed a commit
that referenced
this pull request
Aug 27, 2020
Also improve EE cert selection, user guidance, and documentation. Reviewed-by: Tomas Mraz <[email protected]> (Merged from #12643)
Contributor
Author
|
Merged - thanks @t8m |
swenkeratmicrosoft
pushed a commit
to swenkeratmicrosoft/openssl
that referenced
this pull request
Sep 1, 2020
Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl#12643)
swenkeratmicrosoft
pushed a commit
to swenkeratmicrosoft/openssl
that referenced
this pull request
Sep 1, 2020
Also improve EE cert selection, user guidance, and documentation. Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl#12643)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds the option
-untrustedto the PKCS#12 app andimproves the user guidance for various options both in the app and the man page.
So far, lists of certificates to be used for chain building (with the
-chainoption)could be done only by adding them along with trusted certs (via, e.g., the
-CAfileoption).This is not only inconvenient but also inadequate: they should not be trusted
but used only as candidates for intermediate CA certs as far as needed for building the chain.
In analogy of the
-untrustedoption of the verify app,the new
-untrustedoption offers the possibility to provide intermediate CA certs in a separate fileand passes them (rather than NULL) to
X509_STORE_CTX_init().I also improved the handling of end entity certs (in particular with the
-nokeysoption),made some error messages more informative, added many warnings on inconsistent option use,
and clarified the use of various options in the app help output and documentation.