x509_trust.c: extend trust_compat to allow for id-alg-noSignature as …

…alternative to self-signed
siemens · Oct 16, 2024 · 7016ebc · 7016ebc
1 parent 8ad577d
commit 7016ebc
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/crypto/x509/x509_trust.c b/crypto/x509/x509_trust.c
@@ -241,7 +241,9 @@ static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
     /* Call for side-effect of setting EXFLAG_SS for self-signed-certs */
     if (X509_check_purpose(x, -1, 0) != 1)
         return X509_TRUST_UNTRUSTED;
-    if ((flags & X509_TRUST_NO_SS_COMPAT) == 0 && (x->ex_flags & EXFLAG_SS))
+    if ((flags & X509_TRUST_NO_SS_COMPAT) == 0
+        && ((x->ex_flags & EXFLAG_SS)
+            || OBJ_obj2nid(x->sig_alg.algorithm) == NID_id_alg_noSignature))
         return X509_TRUST_TRUSTED;
     else
         return X509_TRUST_UNTRUSTED;