Make tls1_check_chain return a set of flags indicating checks passed
by a certificate chain. Add additional tests to handle client
certificates: checks for matching certificate type and issuer name
comparison.
Print out results of checks for each candidate chain tested in
s_server/s_client.
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 9547814..eb41cfd 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -467,7 +467,8 @@
if (cpk->authz != NULL)
OPENSSL_free(cpk->authz);
#endif
- cpk->valid_flags = 0;
+ /* Clear all flags apart from explicit sign */
+ cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
}
}
