actually deprecate MD5 and MD2 signatures during X.509 verification by treating them...

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 02964bafc8f9ebb83c535687350cf8c24a3fcd23..c00b4bf4997890d967fb8a4a84e84e2e6dbadde2 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -320,6 +320,7 @@ _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
        {
          if (output)
            *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+         ret = 0;
        }
     }
 
@@ -1036,6 +1037,7 @@ _gnutls_verify_crl2 (gnutls_x509_crl_t crl,
       {
        if (output)
          *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+       ret = 0;
       }
   }