Commit 6ad8c482 authored by Richard Levitte's avatar Richard Levitte
Browse files

Allow proxy certs to be present when verifying a chain 



Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent 30aeb312

apps/apps.c

+2 −0
Original line number Diff line number Diff line
@@ -2374,6 +2374,8 @@ int args_verify(char ***pargs, int *pargc, 
        flags |= X509_V_FLAG_PARTIAL_CHAIN;

    else if (!strcmp(arg, "-no_alt_chains"))

        flags |= X509_V_FLAG_NO_ALT_CHAINS;

    else if (!strcmp(arg, "-allow_proxy_certs"))

        flags |= X509_V_FLAG_ALLOW_PROXY_CERTS;

    else

        return 0;

doc/apps/verify.pod

+5 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ B<openssl> B<verify> 
[B<-use_deltas>]

[B<-policy_print>]

[B<-no_alt_chains>]

[B<-allow_proxy_certs>]

[B<-untrusted file>]

[B<-help>]

[B<-issuer_checks>]
@@ -139,6 +140,10 @@ be found that is trusted. With this option that behaviour is suppressed so that 
only the first chain found is ever used. Using this option will force the

behaviour to match that of previous OpenSSL versions.



=item B<-allow_proxy_certs>



Allow the verification of proxy certificates.



=item B<-trusted file>



A file of additional trusted certificates. The file should contain multiple