Update fixed DH requirements.
authorDr. Stephen Henson <steve@openssl.org>
Wed, 27 Mar 2013 16:05:10 +0000 (16:05 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Wed, 18 Sep 2013 12:46:02 +0000 (13:46 +0100)
The relaxed signing requirements for fixed DH certificates apply to DTLS 1.2
too.
(cherry picked from commit fbbaaccaca32742f09dfb02e5e28dcd20f64a17f)

ssl/s3_clnt.c

index e9c716ff950c23f7b7a21b7d42b1481f40c4cf96..fea40acefb67a3eb1dbbc554588a80a0e41ca616 100644 (file)
@@ -3404,14 +3404,14 @@ int ssl3_check_cert_and_algorithm(SSL *s)
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_KEY);
                goto f_err;
                }
-       else if ((alg_k & SSL_kDHr) && (TLS1_get_version(s) < TLS1_2_VERSION) &&
+       else if ((alg_k & SSL_kDHr) && !SSL_USE_SIGALGS(s) &&
                !has_bits(i,EVP_PK_DH|EVP_PKS_RSA))
                {
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_RSA_CERT);
                goto f_err;
                }
 #ifndef OPENSSL_NO_DSA
-       else if ((alg_k & SSL_kDHd) && (TLS1_get_version(s) < TLS1_2_VERSION) &&
+       else if ((alg_k & SSL_kDHd) && !SSL_USE_SIGALGS(s) &&
                !has_bits(i,EVP_PK_DH|EVP_PKS_DSA))
                {
                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_DH_DSA_CERT);