Commit 315cd871 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

For self signed root only indicate one error. 

(cherry picked from commit bdfc0e284c89dd5781259cc19aa264aded538492)
parent 5693a308

crypto/x509/x509_vfy.c

+5 −2
Original line number Diff line number Diff line
@@ -366,8 +366,11 @@ int X509_verify_cert(X509_STORE_CTX *ctx) 
	/* If explicitly rejected error */

	if (i == X509_TRUST_REJECTED)

		goto end;

	/* If not explicitly trusted then indicate error */

	if (i != X509_TRUST_TRUSTED)

	/* If not explicitly trusted then indicate error unless it's

	 * a single self signed certificate in which case we've indicated

	 * an error already and set bad_chain == 1

	 */

	if (i != X509_TRUST_TRUSTED && !bad_chain)

		{

		if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss))

			{