removed flag GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE

diff --git a/NEWS b/NEWS
index 7fa2360d91e1b1f629860cb013b80dec46f92a37..9c218d3b3e8fb4454549ddd7936e09a00445d301 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -21,9 +21,8 @@ algorithm as well.
 ** libgnutls: the gnutls_handshake() process will enforce a timeout by
 default.
 
-** libgnutls: the verification flag GNUTLS_REQUIRE_KEY_PURPOSE_ON_INTERMEDIATE
-is introduced, and forces the application of the desired key purpose (extended
-key usage) into intermediate certificates. The verification result
+** libgnutls: if a key purpose (extended key usage) is specified for verification,
+it is applied into intermediate certificates. The verification result
 GNUTLS_CERT_PURPOSE_MISMATCH is also introduced. 
 
 ** libgnutls: Added support for the extended master secret

diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h
index 0314bbe38abbcf06d1efe2482245db93bfb9a3d0..5ae554bbeced252e580cd8943c21c849a478423d 100644 (file)
--- a/lib/includes/gnutls/x509.h
+++ b/lib/includes/gnutls/x509.h
@@ -811,10 +811,6 @@ int gnutls_pkcs7_delete_crl(gnutls_pkcs7_t pkcs7, int indx);
  *   using certificate revocation lists or the available OCSP data.
  * @GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS: When including a hostname
  *   check in the verification, do not consider any wildcards.
- * @GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE: When verifying a certificate
- *   and asking for a particular key purpose, require that any intermediate certificates
- *   bear this key purpose as well. This is not enabled by default as this is not part
- *   of RFC5280, but rather is an extension of CA Forum (baseline requirements 1.1.9).
  *
  * Enumeration of different certificate verify flags. Additional
  * verification profiles can be set using GNUTLS_PROFILE_TO_VFLAGS()
@@ -833,7 +829,6 @@ typedef enum gnutls_certificate_verify_flags {
        GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN = 1 << 10,
        GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN = 1 << 11,
        GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS = 1 << 12,
-       GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE = 1 << 13
        /* cannot exceed 2^24 due to GNUTLS_PROFILE_TO_VFLAGS() */
 } gnutls_certificate_verify_flags;
 

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 5f8d4b02055de1d53ca033a4c44583cf1babd095..fafaff274bd1dde48f80793942001a86bf4ad67b 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -952,7 +952,7 @@ _gnutls_verify_crt_status(const gnutls_x509_crt_t * certificate_list,
                if (i - 1 < 0)
                        break;
 
-               if (purpose != NULL && (flags & GNUTLS_VERIFY_KEY_PURPOSE_ON_INTERMEDIATE)) {
+               if (purpose != NULL) {
                        ret = _gnutls_check_key_purpose(certificate_list[i], purpose, 1);
                        if (ret != 1) {
                                gnutls_assert();