From d8c054f2dafbcc22dd8c38cd48ae45bb96dbd475 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Mon, 31 Aug 2015 18:27:57 +0100 Subject: [PATCH] Remove asn1-kludge option. Remove asn1-kludge option from the req utility. It was a decade old workaround for CAs and software which required an invalid encoding of PKCS#10 certificate requests: omitting the attributes field even though it is not OPTIONAL. Reviewed-by: Rich Salz --- apps/req.c | 25 +++---------------------- doc/apps/req.pod | 22 ---------------------- 2 files changed, 3 insertions(+), 44 deletions(-) diff --git a/apps/req.c b/apps/req.c index a16febd6c7..9b017aa7bb 100644 --- a/apps/req.c +++ b/apps/req.c @@ -126,8 +126,8 @@ typedef enum OPTION_choice { OPT_PKEYOPT, OPT_SIGOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS, OPT_VERIFY, OPT_NODES, OPT_NOOUT, OPT_VERBOSE, OPT_UTF8, OPT_NAMEOPT, OPT_REQOPT, OPT_SUBJ, OPT_SUBJECT, OPT_TEXT, OPT_X509, - OPT_ASN1_KLUDGE, OPT_NO_ASN1_KLUDGE, OPT_MULTIVALUE_RDN, - OPT_DAYS, OPT_SET_SERIAL, OPT_EXTENSIONS, OPT_REQEXTS, OPT_MD + OPT_MULTIVALUE_RDN, OPT_DAYS, OPT_SET_SERIAL, OPT_EXTENSIONS, + OPT_REQEXTS, OPT_MD } OPTION_CHOICE; OPTIONS req_options[] = { @@ -163,10 +163,7 @@ OPTIONS req_options[] = { {"text", OPT_TEXT, '-', "Text form of request"}, {"x509", OPT_X509, '-', "Output a x509 structure instead of a cert request"}, - {"asn1-kludge", OPT_ASN1_KLUDGE, '-', - "Output the request in a format that is wrong"}, {OPT_MORE_STR, 1, 1, "(Required by some CA's)"}, - {"no-asn1-kludge", OPT_NO_ASN1_KLUDGE, '-'}, {"subj", OPT_SUBJ, 's', "Set or modify request subject"}, {"subject", OPT_SUBJECT, '-', "Output the request's subject"}, {"multivalue-rdn", OPT_MULTIVALUE_RDN, '-', @@ -208,7 +205,7 @@ int req_main(int argc, char **argv) int pkey_type = -1, private = 0; int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyform = FORMAT_PEM; int modulus = 0, multirdn = 0, verify = 0, noout = 0, text = 0; - int nodes = 0, kludge = 0, newhdr = 0, subject = 0, pubkey = 0; + int nodes = 0, newhdr = 0, subject = 0, pubkey = 0; long newkey = -1; unsigned long chtype = MBSTRING_ASC, nmflag = 0, reqflag = 0; char nmflag_set = 0; @@ -338,12 +335,6 @@ int req_main(int argc, char **argv) case OPT_X509: x509 = 1; break; - case OPT_ASN1_KLUDGE: - kludge = 1; - break; - case OPT_NO_ASN1_KLUDGE: - kludge = 0; - break; case OPT_DAYS: days = atoi(opt_arg()); break; @@ -610,11 +601,6 @@ int req_main(int argc, char **argv) } if (!newreq) { - /* - * Since we are using a pre-existing certificate request, the kludge - * 'format' info should not be changed. - */ - kludge = -1; in = bio_open_default(infile, RB(informat)); if (in == NULL) goto end; @@ -643,11 +629,6 @@ int req_main(int argc, char **argv) i = make_REQ(req, pkey, subj, multirdn, !x509, chtype); subj = NULL; /* done processing '-subj' option */ - if ((kludge > 0) - && !sk_X509_ATTRIBUTE_num(req->req_info->attributes)) { - sk_X509_ATTRIBUTE_free(req->req_info->attributes); - req->req_info->attributes = NULL; - } if (!i) { BIO_printf(bio_err, "problems making Certificate Request\n"); goto end; diff --git a/doc/apps/req.pod b/doc/apps/req.pod index 46bbfe614e..ec19192d19 100644 --- a/doc/apps/req.pod +++ b/doc/apps/req.pod @@ -34,8 +34,6 @@ B B [B<-x509>] [B<-days n>] [B<-set_serial n>] -[B<-asn1-kludge>] -[B<-no-asn1-kludge>] [B<-newhdr>] [B<-extensions section>] [B<-reqexts section>] @@ -274,26 +272,6 @@ a single option or multiple options separated by commas. See discussion of the B<-certopt> parameter in the L command. - -=item B<-asn1-kludge> - -by default the B command outputs certificate requests containing -no attributes in the correct PKCS#10 format. However certain CAs will only -accept requests containing no attributes in an invalid form: this -option produces this invalid format. - -More precisely the B in a PKCS#10 certificate request -are defined as a B. They are B so -if no attributes are present then they should be encoded as an -empty B. The invalid form does not include the empty -B whereas the correct form does. - -It should be noted that very few CAs still require the use of this option. - -=item B<-no-asn1-kludge> - -Reverses effect of B<-asn1-kludge> - =item B<-newhdr> Adds the word B to the PEM file header and footer lines on the outputted -- 2.25.1