1*0Sstevel@tonic-gate /* apps/verify.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate #include <stdio.h> 60*0Sstevel@tonic-gate #include <stdlib.h> 61*0Sstevel@tonic-gate #include <string.h> 62*0Sstevel@tonic-gate #include "apps.h" 63*0Sstevel@tonic-gate #include <openssl/bio.h> 64*0Sstevel@tonic-gate #include <openssl/err.h> 65*0Sstevel@tonic-gate #include <openssl/x509.h> 66*0Sstevel@tonic-gate #include <openssl/x509v3.h> 67*0Sstevel@tonic-gate #include <openssl/pem.h> 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate #undef PROG 70*0Sstevel@tonic-gate #define PROG verify_main 71*0Sstevel@tonic-gate 72*0Sstevel@tonic-gate static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx); 73*0Sstevel@tonic-gate static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X509) *tchain, int purpose, ENGINE *e); 74*0Sstevel@tonic-gate static STACK_OF(X509) *load_untrusted(char *file); 75*0Sstevel@tonic-gate static int v_verbose=0, vflags = 0; 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate int MAIN(int, char **); 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate int MAIN(int argc, char **argv) 80*0Sstevel@tonic-gate { 81*0Sstevel@tonic-gate ENGINE *e = NULL; 82*0Sstevel@tonic-gate int i,ret=1; 83*0Sstevel@tonic-gate int purpose = -1; 84*0Sstevel@tonic-gate char *CApath=NULL,*CAfile=NULL; 85*0Sstevel@tonic-gate char *untfile = NULL, *trustfile = NULL; 86*0Sstevel@tonic-gate STACK_OF(X509) *untrusted = NULL, *trusted = NULL; 87*0Sstevel@tonic-gate X509_STORE *cert_ctx=NULL; 88*0Sstevel@tonic-gate X509_LOOKUP *lookup=NULL; 89*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 90*0Sstevel@tonic-gate char *engine=NULL; 91*0Sstevel@tonic-gate #endif 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate cert_ctx=X509_STORE_new(); 94*0Sstevel@tonic-gate if (cert_ctx == NULL) goto end; 95*0Sstevel@tonic-gate X509_STORE_set_verify_cb_func(cert_ctx,cb); 96*0Sstevel@tonic-gate 97*0Sstevel@tonic-gate ERR_load_crypto_strings(); 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate apps_startup(); 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate if (bio_err == NULL) 102*0Sstevel@tonic-gate if ((bio_err=BIO_new(BIO_s_file())) != NULL) 103*0Sstevel@tonic-gate BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT); 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate if (!load_config(bio_err, NULL)) 106*0Sstevel@tonic-gate goto end; 107*0Sstevel@tonic-gate 108*0Sstevel@tonic-gate argc--; 109*0Sstevel@tonic-gate argv++; 110*0Sstevel@tonic-gate for (;;) 111*0Sstevel@tonic-gate { 112*0Sstevel@tonic-gate if (argc >= 1) 113*0Sstevel@tonic-gate { 114*0Sstevel@tonic-gate if (strcmp(*argv,"-CApath") == 0) 115*0Sstevel@tonic-gate { 116*0Sstevel@tonic-gate if (argc-- < 1) goto end; 117*0Sstevel@tonic-gate CApath= *(++argv); 118*0Sstevel@tonic-gate } 119*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAfile") == 0) 120*0Sstevel@tonic-gate { 121*0Sstevel@tonic-gate if (argc-- < 1) goto end; 122*0Sstevel@tonic-gate CAfile= *(++argv); 123*0Sstevel@tonic-gate } 124*0Sstevel@tonic-gate else if (strcmp(*argv,"-purpose") == 0) 125*0Sstevel@tonic-gate { 126*0Sstevel@tonic-gate X509_PURPOSE *xptmp; 127*0Sstevel@tonic-gate if (argc-- < 1) goto end; 128*0Sstevel@tonic-gate i = X509_PURPOSE_get_by_sname(*(++argv)); 129*0Sstevel@tonic-gate if(i < 0) 130*0Sstevel@tonic-gate { 131*0Sstevel@tonic-gate BIO_printf(bio_err, "unrecognized purpose\n"); 132*0Sstevel@tonic-gate goto end; 133*0Sstevel@tonic-gate } 134*0Sstevel@tonic-gate xptmp = X509_PURPOSE_get0(i); 135*0Sstevel@tonic-gate purpose = X509_PURPOSE_get_id(xptmp); 136*0Sstevel@tonic-gate } 137*0Sstevel@tonic-gate else if (strcmp(*argv,"-untrusted") == 0) 138*0Sstevel@tonic-gate { 139*0Sstevel@tonic-gate if (argc-- < 1) goto end; 140*0Sstevel@tonic-gate untfile= *(++argv); 141*0Sstevel@tonic-gate } 142*0Sstevel@tonic-gate else if (strcmp(*argv,"-trusted") == 0) 143*0Sstevel@tonic-gate { 144*0Sstevel@tonic-gate if (argc-- < 1) goto end; 145*0Sstevel@tonic-gate trustfile= *(++argv); 146*0Sstevel@tonic-gate } 147*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 148*0Sstevel@tonic-gate else if (strcmp(*argv,"-engine") == 0) 149*0Sstevel@tonic-gate { 150*0Sstevel@tonic-gate if (--argc < 1) goto end; 151*0Sstevel@tonic-gate engine= *(++argv); 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate #endif 154*0Sstevel@tonic-gate else if (strcmp(*argv,"-help") == 0) 155*0Sstevel@tonic-gate goto end; 156*0Sstevel@tonic-gate else if (strcmp(*argv,"-ignore_critical") == 0) 157*0Sstevel@tonic-gate vflags |= X509_V_FLAG_IGNORE_CRITICAL; 158*0Sstevel@tonic-gate else if (strcmp(*argv,"-issuer_checks") == 0) 159*0Sstevel@tonic-gate vflags |= X509_V_FLAG_CB_ISSUER_CHECK; 160*0Sstevel@tonic-gate else if (strcmp(*argv,"-crl_check") == 0) 161*0Sstevel@tonic-gate vflags |= X509_V_FLAG_CRL_CHECK; 162*0Sstevel@tonic-gate else if (strcmp(*argv,"-crl_check_all") == 0) 163*0Sstevel@tonic-gate vflags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL; 164*0Sstevel@tonic-gate else if (strcmp(*argv,"-verbose") == 0) 165*0Sstevel@tonic-gate v_verbose=1; 166*0Sstevel@tonic-gate else if (argv[0][0] == '-') 167*0Sstevel@tonic-gate goto end; 168*0Sstevel@tonic-gate else 169*0Sstevel@tonic-gate break; 170*0Sstevel@tonic-gate argc--; 171*0Sstevel@tonic-gate argv++; 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate else 174*0Sstevel@tonic-gate break; 175*0Sstevel@tonic-gate } 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 178*0Sstevel@tonic-gate e = setup_engine(bio_err, engine, 0); 179*0Sstevel@tonic-gate #endif 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file()); 182*0Sstevel@tonic-gate if (lookup == NULL) abort(); 183*0Sstevel@tonic-gate if (CAfile) { 184*0Sstevel@tonic-gate i=X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM); 185*0Sstevel@tonic-gate if(!i) { 186*0Sstevel@tonic-gate BIO_printf(bio_err, "Error loading file %s\n", CAfile); 187*0Sstevel@tonic-gate ERR_print_errors(bio_err); 188*0Sstevel@tonic-gate goto end; 189*0Sstevel@tonic-gate } 190*0Sstevel@tonic-gate } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT); 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir()); 193*0Sstevel@tonic-gate if (lookup == NULL) abort(); 194*0Sstevel@tonic-gate if (CApath) { 195*0Sstevel@tonic-gate i=X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM); 196*0Sstevel@tonic-gate if(!i) { 197*0Sstevel@tonic-gate BIO_printf(bio_err, "Error loading directory %s\n", CApath); 198*0Sstevel@tonic-gate ERR_print_errors(bio_err); 199*0Sstevel@tonic-gate goto end; 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT); 202*0Sstevel@tonic-gate 203*0Sstevel@tonic-gate ERR_clear_error(); 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate if(untfile) { 206*0Sstevel@tonic-gate if(!(untrusted = load_untrusted(untfile))) { 207*0Sstevel@tonic-gate BIO_printf(bio_err, "Error loading untrusted file %s\n", untfile); 208*0Sstevel@tonic-gate ERR_print_errors(bio_err); 209*0Sstevel@tonic-gate goto end; 210*0Sstevel@tonic-gate } 211*0Sstevel@tonic-gate } 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate if(trustfile) { 214*0Sstevel@tonic-gate if(!(trusted = load_untrusted(trustfile))) { 215*0Sstevel@tonic-gate BIO_printf(bio_err, "Error loading untrusted file %s\n", trustfile); 216*0Sstevel@tonic-gate ERR_print_errors(bio_err); 217*0Sstevel@tonic-gate goto end; 218*0Sstevel@tonic-gate } 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate if (argc < 1) check(cert_ctx, NULL, untrusted, trusted, purpose, e); 222*0Sstevel@tonic-gate else 223*0Sstevel@tonic-gate for (i=0; i<argc; i++) 224*0Sstevel@tonic-gate check(cert_ctx,argv[i], untrusted, trusted, purpose, e); 225*0Sstevel@tonic-gate ret=0; 226*0Sstevel@tonic-gate end: 227*0Sstevel@tonic-gate if (ret == 1) { 228*0Sstevel@tonic-gate BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check]"); 229*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 230*0Sstevel@tonic-gate BIO_printf(bio_err," [-engine e]"); 231*0Sstevel@tonic-gate #endif 232*0Sstevel@tonic-gate BIO_printf(bio_err," cert1 cert2 ...\n"); 233*0Sstevel@tonic-gate BIO_printf(bio_err,"recognized usages:\n"); 234*0Sstevel@tonic-gate for(i = 0; i < X509_PURPOSE_get_count(); i++) { 235*0Sstevel@tonic-gate X509_PURPOSE *ptmp; 236*0Sstevel@tonic-gate ptmp = X509_PURPOSE_get0(i); 237*0Sstevel@tonic-gate BIO_printf(bio_err, "\t%-10s\t%s\n", X509_PURPOSE_get0_sname(ptmp), 238*0Sstevel@tonic-gate X509_PURPOSE_get0_name(ptmp)); 239*0Sstevel@tonic-gate } 240*0Sstevel@tonic-gate } 241*0Sstevel@tonic-gate if (cert_ctx != NULL) X509_STORE_free(cert_ctx); 242*0Sstevel@tonic-gate sk_X509_pop_free(untrusted, X509_free); 243*0Sstevel@tonic-gate sk_X509_pop_free(trusted, X509_free); 244*0Sstevel@tonic-gate apps_shutdown(); 245*0Sstevel@tonic-gate OPENSSL_EXIT(ret); 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate 248*0Sstevel@tonic-gate static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X509) *tchain, int purpose, ENGINE *e) 249*0Sstevel@tonic-gate { 250*0Sstevel@tonic-gate X509 *x=NULL; 251*0Sstevel@tonic-gate int i=0,ret=0; 252*0Sstevel@tonic-gate X509_STORE_CTX *csc; 253*0Sstevel@tonic-gate 254*0Sstevel@tonic-gate x = load_cert(bio_err, file, FORMAT_PEM, NULL, e, "certificate file"); 255*0Sstevel@tonic-gate if (x == NULL) 256*0Sstevel@tonic-gate goto end; 257*0Sstevel@tonic-gate fprintf(stdout,"%s: ",(file == NULL)?"stdin":file); 258*0Sstevel@tonic-gate 259*0Sstevel@tonic-gate csc = X509_STORE_CTX_new(); 260*0Sstevel@tonic-gate if (csc == NULL) 261*0Sstevel@tonic-gate { 262*0Sstevel@tonic-gate ERR_print_errors(bio_err); 263*0Sstevel@tonic-gate goto end; 264*0Sstevel@tonic-gate } 265*0Sstevel@tonic-gate X509_STORE_set_flags(ctx, vflags); 266*0Sstevel@tonic-gate if(!X509_STORE_CTX_init(csc,ctx,x,uchain)) 267*0Sstevel@tonic-gate { 268*0Sstevel@tonic-gate ERR_print_errors(bio_err); 269*0Sstevel@tonic-gate goto end; 270*0Sstevel@tonic-gate } 271*0Sstevel@tonic-gate if(tchain) X509_STORE_CTX_trusted_stack(csc, tchain); 272*0Sstevel@tonic-gate if(purpose >= 0) X509_STORE_CTX_set_purpose(csc, purpose); 273*0Sstevel@tonic-gate i=X509_verify_cert(csc); 274*0Sstevel@tonic-gate X509_STORE_CTX_free(csc); 275*0Sstevel@tonic-gate 276*0Sstevel@tonic-gate ret=0; 277*0Sstevel@tonic-gate end: 278*0Sstevel@tonic-gate if (i) 279*0Sstevel@tonic-gate { 280*0Sstevel@tonic-gate fprintf(stdout,"OK\n"); 281*0Sstevel@tonic-gate ret=1; 282*0Sstevel@tonic-gate } 283*0Sstevel@tonic-gate else 284*0Sstevel@tonic-gate ERR_print_errors(bio_err); 285*0Sstevel@tonic-gate if (x != NULL) X509_free(x); 286*0Sstevel@tonic-gate 287*0Sstevel@tonic-gate return(ret); 288*0Sstevel@tonic-gate } 289*0Sstevel@tonic-gate 290*0Sstevel@tonic-gate static STACK_OF(X509) *load_untrusted(char *certfile) 291*0Sstevel@tonic-gate { 292*0Sstevel@tonic-gate STACK_OF(X509_INFO) *sk=NULL; 293*0Sstevel@tonic-gate STACK_OF(X509) *stack=NULL, *ret=NULL; 294*0Sstevel@tonic-gate BIO *in=NULL; 295*0Sstevel@tonic-gate X509_INFO *xi; 296*0Sstevel@tonic-gate 297*0Sstevel@tonic-gate if(!(stack = sk_X509_new_null())) { 298*0Sstevel@tonic-gate BIO_printf(bio_err,"memory allocation failure\n"); 299*0Sstevel@tonic-gate goto end; 300*0Sstevel@tonic-gate } 301*0Sstevel@tonic-gate 302*0Sstevel@tonic-gate if(!(in=BIO_new_file(certfile, "r"))) { 303*0Sstevel@tonic-gate BIO_printf(bio_err,"error opening the file, %s\n",certfile); 304*0Sstevel@tonic-gate goto end; 305*0Sstevel@tonic-gate } 306*0Sstevel@tonic-gate 307*0Sstevel@tonic-gate /* This loads from a file, a stack of x509/crl/pkey sets */ 308*0Sstevel@tonic-gate if(!(sk=PEM_X509_INFO_read_bio(in,NULL,NULL,NULL))) { 309*0Sstevel@tonic-gate BIO_printf(bio_err,"error reading the file, %s\n",certfile); 310*0Sstevel@tonic-gate goto end; 311*0Sstevel@tonic-gate } 312*0Sstevel@tonic-gate 313*0Sstevel@tonic-gate /* scan over it and pull out the certs */ 314*0Sstevel@tonic-gate while (sk_X509_INFO_num(sk)) 315*0Sstevel@tonic-gate { 316*0Sstevel@tonic-gate xi=sk_X509_INFO_shift(sk); 317*0Sstevel@tonic-gate if (xi->x509 != NULL) 318*0Sstevel@tonic-gate { 319*0Sstevel@tonic-gate sk_X509_push(stack,xi->x509); 320*0Sstevel@tonic-gate xi->x509=NULL; 321*0Sstevel@tonic-gate } 322*0Sstevel@tonic-gate X509_INFO_free(xi); 323*0Sstevel@tonic-gate } 324*0Sstevel@tonic-gate if(!sk_X509_num(stack)) { 325*0Sstevel@tonic-gate BIO_printf(bio_err,"no certificates in file, %s\n",certfile); 326*0Sstevel@tonic-gate sk_X509_free(stack); 327*0Sstevel@tonic-gate goto end; 328*0Sstevel@tonic-gate } 329*0Sstevel@tonic-gate ret=stack; 330*0Sstevel@tonic-gate end: 331*0Sstevel@tonic-gate BIO_free(in); 332*0Sstevel@tonic-gate sk_X509_INFO_free(sk); 333*0Sstevel@tonic-gate return(ret); 334*0Sstevel@tonic-gate } 335*0Sstevel@tonic-gate 336*0Sstevel@tonic-gate static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx) 337*0Sstevel@tonic-gate { 338*0Sstevel@tonic-gate char buf[256]; 339*0Sstevel@tonic-gate 340*0Sstevel@tonic-gate if (!ok) 341*0Sstevel@tonic-gate { 342*0Sstevel@tonic-gate X509_NAME_oneline( 343*0Sstevel@tonic-gate X509_get_subject_name(ctx->current_cert),buf, 344*0Sstevel@tonic-gate sizeof buf); 345*0Sstevel@tonic-gate printf("%s\n",buf); 346*0Sstevel@tonic-gate printf("error %d at %d depth lookup:%s\n",ctx->error, 347*0Sstevel@tonic-gate ctx->error_depth, 348*0Sstevel@tonic-gate X509_verify_cert_error_string(ctx->error)); 349*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_CERT_HAS_EXPIRED) ok=1; 350*0Sstevel@tonic-gate /* since we are just checking the certificates, it is 351*0Sstevel@tonic-gate * ok if they are self signed. But we should still warn 352*0Sstevel@tonic-gate * the user. 353*0Sstevel@tonic-gate */ 354*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1; 355*0Sstevel@tonic-gate /* Continue after extension errors too */ 356*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_INVALID_CA) ok=1; 357*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_PATH_LENGTH_EXCEEDED) ok=1; 358*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_INVALID_PURPOSE) ok=1; 359*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1; 360*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_CRL_HAS_EXPIRED) ok=1; 361*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_CRL_NOT_YET_VALID) ok=1; 362*0Sstevel@tonic-gate if (ctx->error == X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION) ok=1; 363*0Sstevel@tonic-gate } 364*0Sstevel@tonic-gate if (!v_verbose) 365*0Sstevel@tonic-gate ERR_clear_error(); 366*0Sstevel@tonic-gate return(ok); 367*0Sstevel@tonic-gate } 368*0Sstevel@tonic-gate 369