Fix verify algorithm.
Disable loop checking when we retry verification with an alternative path. This fixes the case where an intermediate CA is explicitly trusted and part of the untrusted certificate list. By disabling loop checking for this case the untrusted CA can be replaced by the explicitly trusted case and verification will succeed. Signed-off-by: Matt Caswell <matt@openssl.org> (cherry picked from commit e5991ec5 ) Reviewed-by: Rich Salz <rsalz@openssl.org>
parent
be856c03
Please register or sign in to comment