From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sun, 10 Feb 2002 21:58:44 +0000 (+0000)
Subject: *** empty log message ***
X-Git-Tag: gnutls_0_3_90~80
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bfea991adb0d7d02a3cf6327deb9612ceda11bc4;p=thirdparty%2Fgnutls.git

*** empty log message ***
---

diff --git a/lib/x509_verify.c b/lib/x509_verify.c
index 2171ae2d77..8af966f4b5 100644
--- a/lib/x509_verify.c
+++ b/lib/x509_verify.c
@@ -305,6 +305,17 @@ int gnutls_verify_certificate2(gnutls_cert * cert, gnutls_cert * trusted_cas, in
 	return GNUTLS_CERT_TRUSTED;
 }
 
+/* The algorithm used is:
+ * 1. Check the certificate chain given by the peer, if it is ok.
+ * 2. If any certificate in the chain are expired, revoked or not
+ *    valid, then the certificate is not trusted.
+ * 3. If 1 is ok, then find a certificate in the trusted CAs file
+ *    that has the DN of the issuer field in the last certificate
+ *    in the peer's certificate chain.
+ * 4. If it does exist then verify it. If verification is ok then
+ *    it is trusted.
+ * 5. In all other cases the certificate is not trusted.
+ */
 /* This function verifies a X.509 certificate list. The certificate list should
  * lead to a trusted CA in order to be trusted.
  */