lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Merge pull request #4619 from TRodziewicz/remove_MBEDTLS_X509_CHECK_x_KEY_USAGE_options

Browse Source 
Remove MBEDTLS_X509_CHECK_*_KEY_USAGE options but enable the code
This commit is contained in:
Gilles Peskine
2021-06-10 17:43:36 +02:00
committed by GitHub
parent 44eea8f067 2a5e5a2759
commit 02b76b7d18
9 changed files with 27 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/3.0-migration-guide.d/remove_MBEDTLS_X509_CHECK_x_KEY_USAGE_options.md Normal file
View File

@ -0,0 +1,18 @@
Remove `MBEDTLS_X509_CHECK_*_KEY_USAGE` options from `config.h`
-------------------------------------------------------------------
This change affects users who have chosen the configuration options to disable the
library's verification of the `keyUsage` and `extendedKeyUsage` fields of x509
certificates.
The `MBEDTLS_X509_CHECK_KEY_USAGE` and `MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE`
configuration options are removed and the X509 code now behaves as if they were
always enabled. It is consequently not possible anymore to disable at compile
time the verification of the `keyUsage` and `extendedKeyUsage` fields of X509
certificates.
The verification of the `keyUsage` and `extendedKeyUsage` fields is important,
disabling it can cause security issues and it is thus not recommended. If the
verification is for some reason undesirable, it can still be disabled by means
of the verification callback function passed to `mbedtls_x509_crt_verify()` (see
the documentation of this function for more information).