From f87ead980187ba39c66eb6ed5825603ea343b73f Mon Sep 17 00:00:00 2001 From: "Dr. David von Oheimb" Date: Fri, 13 Nov 2020 21:45:46 +0100 Subject: [PATCH] ossl_cmp_certreq_new(): Fix POPO key mismatch in case newPkey is just public key Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/13409) --- crypto/cmp/cmp_msg.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crypto/cmp/cmp_msg.c b/crypto/cmp/cmp_msg.c index 1a4a8731687..45cda58879b 100644 --- a/crypto/cmp/cmp_msg.c +++ b/crypto/cmp/cmp_msg.c @@ -334,7 +334,12 @@ OSSL_CMP_MSG *ossl_cmp_certreq_new(OSSL_CMP_CTX *ctx, int type, if (type != OSSL_CMP_PKIBODY_P10CR) { EVP_PKEY *privkey = OSSL_CMP_CTX_get0_newPkey(ctx, 1); - if (privkey == NULL) + /* + * privkey is NULL in case ctx->newPkey does not include a private key. + * We then may try to use ctx->pkey as fallback/default, but only + * if ctx-> newPkey does not include a (non-matching) public key: + */ + if (privkey == NULL && OSSL_CMP_CTX_get0_newPkey(ctx, 0) == NULL) privkey = ctx->pkey; /* default is independent of ctx->oldCert */ if (ctx->popoMethod == OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) { ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY); -- 2.47.2