Commit dacdc5fe authored by Matt Caswell's avatar Matt Caswell
Browse files

Allow multiple entries without a Subject even if unique_subject == yes 



It is quite likely for there to be multiple certificates with empty
subjects, which are still distinct because of subjectAltName. Therefore
we allow multiple certificates with an empty Subject even if
unique_subject is set to yes.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5445)
parent 50615b3c

apps/ca.c

+19 −0
Original line number Diff line number Diff line
@@ -2003,6 +2003,20 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, 
        goto err;

    }



    if (row[DB_name][0] == '\0') {

        /*

         * An empty subject! We'll use the serial number instead. If

         * unique_subject is in use then we don't want different entries with

         * empty subjects matching each other.

         */

        OPENSSL_free(row[DB_name]);

        row[DB_name] = OPENSSL_strdup(row[DB_serial]);

        if (row[DB_name] == NULL) {

            BIO_printf(bio_err, "Memory allocation failure\n");

            goto err;

        }

    }



    if (db->attributes.unique_subject) {

        OPENSSL_STRING *crow = row;
@@ -2353,6 +2367,11 @@ static int do_revoke(X509 *x509, CA_DB *db, int type, char *value) 
    else

        row[DB_serial] = BN_bn2hex(bn);

    BN_free(bn);

    if (row[DB_name] != NULL && row[DB_name][0] == '\0') {

        /* Entries with empty Subjects actually use the serial number instead */

        OPENSSL_free(row[DB_name]);

        row[DB_name] = OPENSSL_strdup(row[DB_serial]);

    }

    if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {

        BIO_printf(bio_err, "Memory allocation failure\n");

        goto err;

doc/apps/ca.pod

+4 −0
Original line number Diff line number Diff line
@@ -424,6 +424,10 @@ versions of OpenSSL. However, to make CA certificate roll-over easier, 
it's recommended to use the value B<no>, especially if combined with

the B<-selfsign> command line option.



Note that it is valid in some circumstances for certificates to be created

without any subject. In the case where there are multiple certificates without

subjects this does not count as a duplicate.



=item B<serial>



a text file containing the next serial number to use in hex. Mandatory.