openssl: Only allow certificates with cRLSign keyUsage to sign CRLs

diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 92f0ab481d57fe9ea496a114c37d26a17d4deeae..907a5fb2a3b7d097b40b7468f8afd2219c232220 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -303,7 +303,7 @@ METHOD(certificate_t, issued_by, bool,
                return FALSE;
        }
        x509 = (x509_t*)issuer;
-       if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN)))
+       if (!(x509->get_flags(x509) & X509_CRL_SIGN))
        {
                return FALSE;
        }