#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/pem.h>
-#include <openssl/engine.h>
#undef PROG
#define PROG verify_main
}
else if (strcmp(*argv,"-help") == 0)
goto end;
+ else if (strcmp(*argv,"-ignore_critical") == 0)
+ vflags |= X509_V_FLAG_IGNORE_CRITICAL;
else if (strcmp(*argv,"-issuer_checks") == 0)
vflags |= X509_V_FLAG_CB_ISSUER_CHECK;
else if (strcmp(*argv,"-crl_check") == 0)
goto end;
}
X509_STORE_set_flags(ctx, vflags);
- X509_STORE_CTX_init(csc,ctx,x,uchain);
+ if(!X509_STORE_CTX_init(csc,ctx,x,uchain))
+ {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
if(tchain) X509_STORE_CTX_trusted_stack(csc, tchain);
if(purpose >= 0) X509_STORE_CTX_set_purpose(csc, purpose);
i=X509_verify_cert(csc);
if (ctx->error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ok=1;
if (ctx->error == X509_V_ERR_CRL_HAS_EXPIRED) ok=1;
if (ctx->error == X509_V_ERR_CRL_NOT_YET_VALID) ok=1;
+ if (ctx->error == X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION) ok=1;
}
if (!v_verbose)
ERR_clear_error();