Fix regression in openssl req -x509 behaviour.

Allow conversion of existing requests to certificates again.
Fixes the issue #3396

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3437)

diff --git a/apps/req.c b/apps/req.c
index f1dba66041ab71863757df410e535a1db5bbca6f..a47dfcffafced7878c5661be1e4b0a0a1f186dd4 100644 (file)
--- a/apps/req.c
+++ b/apps/req.c
@@ -288,7 +288,6 @@ int req_main(int argc, char **argv)
             break;
         case OPT_X509:
             x509 = 1;
             break;
         case OPT_X509:
             x509 = 1;

-            newreq = 1;

             break;
         case OPT_DAYS:
             days = atoi(opt_arg());
             break;
         case OPT_DAYS:
             days = atoi(opt_arg());


@@ -331,6 +330,9 @@ int req_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
     if (argc != 0)
         goto opthelp;
 

+    if (x509 && infile == NULL)
+        newreq = 1;
+

     /* TODO: simplify this as pkey is still always NULL here */
     private = newreq && (pkey == NULL) ? 1 : 0;
 
     /* TODO: simplify this as pkey is still always NULL here */
     private = newreq && (pkey == NULL) ? 1 : 0;
 


@@ -582,7 +584,7 @@ int req_main(int argc, char **argv)
         }
     }
 
         }
     }
 

-    if (newreq) {
+    if (newreq || x509) {

         if (pkey == NULL) {
             BIO_printf(bio_err, "you need to specify a private key\n");
             goto end;
         if (pkey == NULL) {
             BIO_printf(bio_err, "you need to specify a private key\n");
             goto end;

diff --git a/doc/man1/req.pod b/doc/man1/req.pod
index f9e424b2b4cc79591a55f4a661363eaf681e1dbf..4dbd489ffe76cddc8e6728cb38655cb4169b8f38 100644 (file)
--- a/doc/man1/req.pod
+++ b/doc/man1/req.pod
@@ -234,6 +234,9 @@ a self signed root CA. The extensions added to the certificate
 using the B<set_serial> option, a large random number will be used for
 the serial number.
 
 using the B<set_serial> option, a large random number will be used for
 the serial number.
 

+If existing request is specified with the B<-in> option, it is converted
+to the self signed certificate otherwise new request is created.
+

 =item B<-days n>
 
 When the B<-x509> option is being used this specifies the number of
 =item B<-days n>
 
 When the B<-x509> option is being used this specifies the number of