]> git.ipfire.org Git - thirdparty/openssl.git/commit
Fix NID bug in SSL_CERT_LOOKUP array construction
authorRichard Levitte <levitte@openssl.org>
Wed, 29 Oct 2025 09:03:51 +0000 (10:03 +0100)
committerRichard Levitte <levitte@openssl.org>
Thu, 30 Oct 2025 18:03:25 +0000 (19:03 +0100)
commitaedcdc6d0f5bfb16af7d0065157af84e671159e0
tree9f517648f0f71b52cecd855d5e31bffc3e372180
parentdc7bf314e37f5c458cd20e11fbea925d2660242d
Fix NID bug in SSL_CERT_LOOKUP array construction

The SSL_CERT_LOOKUP NID should be for the public key algorithm (what is
often called the "key type".  Yet, when populating the SSL_CERT_LOOKUP
table with 'ssl_load_sigalgs', only the sigalg name is used to find a
NID.

This is perfectly OK to do, *if* the sigalg and the associated key type
share the same name.  However, that's not always the case.

This change infers the key type name in 'ssl_load_sigalgs' the same way
as it was already done in 'add_provider_sigalgs'.

Related-to: https://github.com/openssl/openssl/pull/29019#discussion_r2472219647
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29027)
ssl/t1_lib.c