diff options
| author | Magnus Henoch <[email protected]> | 2016-01-29 18:47:43 +0000 |
|---|---|---|
| committer | Magnus Henoch <[email protected]> | 2016-02-17 10:05:26 +0000 |
| commit | a567dca5ea418a0aaaed8fb4359032b11f28cccd (patch) | |
| tree | 06e623b56e43f70e14b4019dc8a4783e0f966a1b /lib/ssl/src | |
| parent | 6945881b99aeadaf9ed4ec1f8c7811538cee1405 (diff) | |
| download | otp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.tar.gz otp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.tar.bz2 otp-a567dca5ea418a0aaaed8fb4359032b11f28cccd.zip | |
ssl: with verify_none, accept critical extensions
When establishing a TLS connection with {verify, verify_none}, if the
server has a certificate with a critical extension, for example a
"Netscape Cert Type" extension, certificate verification would fail,
which is surprising given that the name of the option suggests that no
verification would be performed.
With this change, certificate extensions marked as critical are
ignored when using verify_none.
Diffstat (limited to 'lib/ssl/src')
| -rw-r--r-- | lib/ssl/src/ssl.erl | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl index 6551308935..401ee63908 100644 --- a/lib/ssl/src/ssl.erl +++ b/lib/ssl/src/ssl.erl @@ -1280,6 +1280,12 @@ handle_verify_options(Opts, CaCerts) -> DefaultVerifyNoneFun = {fun(_,{bad_cert, _}, UserState) -> {valid, UserState}; + (_,{extension, #'Extension'{critical = true}}, UserState) -> + %% This extension is marked as critical, so + %% certificate verification should fail if we don't + %% understand the extension. However, this is + %% `verify_none', so let's accept it anyway. + {valid, UserState}; (_,{extension, _}, UserState) -> {unknown, UserState}; (_, valid, UserState) -> |