Add X509 related libctx changes.
- In order to not add many X509_XXXX_with_libctx() functions the libctx and propq may be stored in the X509 object via a call to X509_new_with_libctx().
- Loading via PEM_read_bio_X509() or d2i_X509() should pass in a created cert using X509_new_with_libctx().
- Renamed some XXXX_ex() to XXX_with_libctx() for X509 API's.
- Removed the extra parameters in check_purpose..
- X509_digest() has been modified so that it expects a const EVP_MD object() and then internally it does the fetch when it needs to (via ASN1_item_digest_with_libctx()).
- Added API's that set the libctx when they load such as X509_STORE_new_with_libctx() so that the cert chains can be verified.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12153)
diff --git a/apps/ts.c b/apps/ts.c
index da4584a..09c586b 100644
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -957,6 +957,8 @@
{
X509_STORE *cert_ctx = NULL;
X509_LOOKUP *lookup = NULL;
+ OPENSSL_CTX *libctx = app_get0_libctx();
+ const char *propq = app_get0_propq();
cert_ctx = X509_STORE_new();
X509_STORE_set_verify_cb(cert_ctx, verify_cb);
@@ -978,7 +980,9 @@
BIO_printf(bio_err, "memory allocation failure\n");
goto err;
}
- if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
+ if (!X509_LOOKUP_load_file_with_libctx(lookup, CAfile,
+ X509_FILETYPE_PEM,
+ libctx, propq)) {
BIO_printf(bio_err, "Error loading file %s\n", CAfile);
goto err;
}
@@ -990,7 +994,7 @@
BIO_printf(bio_err, "memory allocation failure\n");
goto err;
}
- if (!X509_LOOKUP_load_store(lookup, CAstore)) {
+ if (!X509_LOOKUP_load_store_with_libctx(lookup, CAstore, libctx, propq)) {
BIO_printf(bio_err, "Error loading store URI %s\n", CAstore);
goto err;
}
