[gnurl] 110/411: openssl: consider ALERT_CERTIFICATE_EXPIRED a failed verification

[gnunet]

This is an automated email from the git hooks/post-receive script.

nikita pushed a commit to branch master
in repository gnurl.

commit 6d946ad9feb7d5809f071e4da6125fed28a04be0
Author: Daniel Stenberg <daniel@haxx.se>
AuthorDate: Mon Sep 7 16:20:16 2020 +0200

    openssl: consider ALERT_CERTIFICATE_EXPIRED a failed verification
    
    If the error reason from the lib is
    SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED, libcurl will return
    CURLE_PEER_FAILED_VERIFICATION and not CURLE_SSL_CONNECT_ERROR.
    
    This unifies the libcurl return code and makes libressl run test 313
    (CRL testing) fine.
    
    Closes #5934
---
 lib/vtls/openssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 5d3da8234..0a5a37384 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -3285,7 +3285,8 @@ static CURLcode ossl_connect_step2(struct connectdata 
*conn, int sockindex)
       reason = ERR_GET_REASON(errdetail);
 
       if((lib == ERR_LIB_SSL) &&
-         (reason == SSL_R_CERTIFICATE_VERIFY_FAILED)) {
+         ((reason == SSL_R_CERTIFICATE_VERIFY_FAILED) ||
+          (reason == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED))) {
         result = CURLE_PEER_FAILED_VERIFICATION;
 
         lerr = SSL_get_verify_result(backend->handle);

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.