lukechilds/node - node - Gitea: Git with a cup of tea

11760 Commits

131 Branches

446 Tags

325 MiB

Tree: 59f6b5da2a

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Shigeki Ohtsu	9e890fe8b4	crypto: fix VerifyCallback in case of verify error `3beb880716` has a bug in VerifyCallback when preverify is 1 and the cert chain has an verify error. If the error is UNABLE_TO_GET_ISSUER_CERT_LOCALLY, it leads an assertion error in finding rootCA. The whitelist check should be made only when the cert chain has no verify error with X509_V_OK. Fixes: https://github.com/nodejs/io.js/issues/2061 PR-URL: https://github.com/nodejs/io.js/pull/2064 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	10 years ago
Shigeki Ohtsu	3beb880716	crypto: add cert check to CNNIC Whitelist When client connect to the server with certification issued by either CNNIC Root CA or CNNIC EV Root CA, check hash of server certification in the list of CNNICHashWhitelist.inc. If it's not, CERT_REVOKED error returns. See for details in https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/ PR-URL: https://github.com/nodejs/io.js/pull/1895 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	10 years ago

Shigeki Ohtsu

9e890fe8b4

crypto: fix VerifyCallback in case of verify error

3beb880716 has a bug in VerifyCallback
when preverify is 1 and the cert chain has an verify error. If the
error is UNABLE_TO_GET_ISSUER_CERT_LOCALLY, it leads an assertion
error in finding rootCA.
The whitelist check should be made only when the cert chain has no
verify error with X509_V_OK.

Fixes: https://github.com/nodejs/io.js/issues/2061
PR-URL: https://github.com/nodejs/io.js/pull/2064
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

10 years ago

Shigeki Ohtsu

3beb880716

crypto: add cert check to CNNIC Whitelist

When client connect to the server with certification issued by either
CNNIC Root CA or CNNIC EV Root CA, check hash of server
certification in the list of CNNICHashWhitelist.inc. If it's not,
CERT_REVOKED error returns.

See for details in
https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/

PR-URL: https://github.com/nodejs/io.js/pull/1895
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

10 years ago

2 Commits (59f6b5da2ab8d5db7029641707e9aa0b0f4dae15)