#include <SSLCertVerifyCallback.h>
Static Public Member Functions | |
int | main (X509_STORE_CTX *X509StoreContext, void *argument) |
int | checkIssued (X509_STORE_CTX *X509StoreContext, X509 *certificate, X509 *candidateIssuerCertificate) |
|
Replacement to the OpenSSL check_issued function pointed to by X509_STORE_CTX.check_issued. It recognises issuer certificates which have the X509v3 Key Usage extension field present but without the CA_Sign authorisation specified in it, when the issuer has signed a proxy certificate. The default OpenSSL implementation won't recognise an issuer which has the Key Usage extension field present but doesn't have the CA Sign bit set in it. Both versions recognise issuers which don't have the Key Usage extension field present at all.
|
|
Callback function. Replace X509StoreContext->check_issued and then call the default OpenSSL X509_verify_cert. Signature is as required for OpenSSL 0.9.7 SSL_CTX_set_cert_verify_callback(). |