pkcs11: when a signer isn't found in PKCS #11 force the verification of the chain

That allows obtaining any additional flags from the chain such as insecure
algorithms or expirations.

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index e71832d9edc3fffe38015ae302f74cdef27daebc..22902206f09cf149c036ec3e4804f12cb524d0e5 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -1144,6 +1144,11 @@ _gnutls_pkcs11_verify_crt_status(const char* url,
 
                status |= GNUTLS_CERT_INVALID;
                status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
+               /* verify the certificate list against 0 trusted CAs in order
+                * to get, any additional flags from the certificate list (e.g.,
+                * insecure algorithms or expired */
+               status |= _gnutls_verify_crt_status(certificate_list, clist_size,
+                                                   NULL, 0, flags, func);
                goto cleanup;
        }