From: Richard Levitte <levitte@openssl.org>
Date: Tue, 26 Sep 2017 08:46:10 +0000 (+0200)
Subject: Make sure that a cert with extensions gets version number 2 (v3)
X-Git-Tag: OpenSSL_1_1_0g~63
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=64aa3d080ed66bd4e1829120312f5a840807c856;p=oweals%2Fopenssl.git

Make sure that a cert with extensions gets version number 2 (v3)

Fixes #4419

Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4420)

(cherry picked from commit 4881d849da23528e19b7312f963d28916d9804b1)
---

diff --git a/apps/ca.c b/apps/ca.c
index 350a748436..3b2afd6949 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1719,7 +1719,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* Lets add the extensions, if there are any */
     if (ext_sect) {
         X509V3_CTX ctx;
-        X509_set_version(ret, 2);
 
         /* Initialize the context structure */
         if (selfsign)
@@ -1774,6 +1773,15 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
         goto end;
     }
 
+    {
+        const STACK_OF(X509_EXTENSION) *exts = X509_get0_extensions(ret);
+
+        if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0)
+            /* Make it an X509 v3 certificate. */
+            if (!X509_set_version(ret, 2))
+                goto end;
+    }
+
     /* Set the right value for the noemailDN option */
     if (email_dn == 0) {
         if (!X509_set_subject_name(ret, dn_subject))