Fix bogus check for EVP_PKEY mandatory digest in check_cert_usable()
authorDavid Woodhouse <dwmw2@infradead.org>
Thu, 22 Aug 2019 17:42:05 +0000 (18:42 +0100)
committerTomas Mraz <tmraz@fedoraproject.org>
Wed, 4 Sep 2019 14:19:46 +0000 (16:19 +0200)
commit9757a5ad8a3bb3869fc0e159b10ff6061c9d0eda
tree532356979b582fd1c8d1fa4104f811c721b259d1
parent1bf29d497e66efef0fbc9b1864d8a5db64bf898e
Fix bogus check for EVP_PKEY mandatory digest in check_cert_usable()

In commit 6aca8d1a5 ("Honour mandatory digest on private key in
has_usable_cert()") I added two checks for the capabilities of the
EVP_PKEY being used. One of them was wrong, as it should only be
checking the signature of the X.509 cert (by its issuer) against the
sigalgs given in a TLS v1.3 signature_algorithms_cert extension.

Remove it.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9705)
ssl/t1_lib.c