x509_trust.c: extend trust_compat() to allow for id-alg-noSignature a…

…s alternative to self-signed
siemens · Oct 16, 2024 · 43f6583 · 43f6583
1 parent b653842
commit 43f6583
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/crypto/x509/x509_trust.c b/crypto/x509/x509_trust.c
@@ -241,7 +241,9 @@ static int trust_compat(X509_TRUST *trust, X509 *x, int flags)
     /* Call for side-effect of setting EXFLAG_SS for self-signed-certs */
     if (X509_check_purpose(x, -1, 0) != 1)
         return X509_TRUST_UNTRUSTED;
-    if ((flags & X509_TRUST_NO_SS_COMPAT) == 0 && (x->ex_flags & EXFLAG_SS))
+    if ((flags & X509_TRUST_NO_SS_COMPAT) == 0
+        && ((x->ex_flags & EXFLAG_SS)
+            || OBJ_obj2nid(x->sig_alg.algorithm) == NID_id_alg_noSignature))
         return X509_TRUST_TRUSTED;
     else
         return X509_TRUST_UNTRUSTED;