Project moved to https://github.com/mpeylo/cmpossl
Project moved to https://github.com/mpeylo/cmpossl
project moved to https://github.com/mpeylo/cmpossl
Home
Home
Home
clarified documentation of -verify_hostname, -verify_ip, -verify_email
fix recently introduced bug which did not allow empty -reqexts
added -policies and -policies_critical option; adding policy OID parse error to lib
added -san_critical option; re-arranged options for improved structuring and consistency
added default SAN inheritance from refernce cert unless new -san_nodefault option is set
added error if multiple sources of SAN; renamed 'oldcert' variable to 'prevcert'
added -san_dns and -san_ip options for adding Subject Alternative Names
improved doc w.r.t. -subject and -oldcert; renamed 'prevcert' variable to 'refcert'
fixed use of password input in load_certs_autofmt()
refactoring: extracted crm_new() from CMP_certreq_new()
fixed loading of client cert in load_certs_also_pkcs12()
fixed bug: policy and SAN extensions were only added if ctx->reqExtensions set
updated issue #s, added checks, refactoring: moved and compacted CMP_pollReq_new()
added OpenSSL 1.0.2 compatibility define for X509_CRL_get0_nextUpdate
(re)-added OpenSSL_add_all_algorithms() needed for SHA256 with OpenSSL 1.0.2
refactoring: extracted transform_opts() from (large) setup_ctx()
refactoring: extracted (still large) setup_ssl_ctx() from (still huge) setup_ctx()
refactoring: got rid of complicated OPT_ITERATE macro in apps/cmp.c
refactoring: extracted setup_request_ctx() from (still very large) setup_ctx()
added warning if CRL in -crls has expired; fixed double free on error
minor generalization of load_untrusted(), renamining it to load_certs_multifile()
enable to use further certs in -cert and -tls_cert as extraCerts/TLS client chain
removed duplicate CLI options check w.r.t. -unprotectedrequests and protection credentials
restored certConf cert error output, simplifying code around CMP_validate_cert_path()
refactoring: extracted setup_protection_ctx() from (large) setup_ctx()
generalizied load_certs_multifile() towards independent upstream submission
refactoring: extracted setup_verification_ctx() from setup_ctx(); improved error reporting
using passwords on loading certificates from p12 files not documented
Adapt openSSL coding style
Done
done
certConf callback should be able to override initial check results by lib
very minor UI improvements
improved compatibility of cert_acceptable() with OPENSSL_VERSION_NUMBER < 0x10100005L
added forgotten backslashes to reformatted macro definition
improved backport CRMF BPM code w.r.t. ASN1_INTEGER_get_uin64() for Linux with OpenSSL 1.0.2
cleanup of CMP_PKISTATUSINFO_snprint() now also displaying multiple PKIFailureInfo entries
improved adherence to OpenSSL coding guidelines w.r.t. 80 char limit
restored backward compatibility with <1.1.0 for internal #include in cmp_lib.c
simplified backport CRMF BPM code w.r.t. ASN1_INTEGER_get_uin64()
replaced _opts by _arg for consistency; replaced set1_transfer by set_transfer; improved docu
reformatting etc. for adherence to OpenSSL coding guidelines for apps/cmp.c
Validate and overwork how subject/alt/names are set in certreq_new()
extended diagnostics of CMP_CERTREPMESSAGE_certResponse_get0() and CMP_POLLREPCONTENT_pollRep_get0()
fix bug#47: renamed -storepass to -certpass, slightly improving its CLI documentation
re-enabled cert verify error output for certConf_cb() solving ERR_clear_error() issue
removed wrongly remaining diagnostic info from cert_acceptable() when used before calling ERR_set_mark()
The typical console output of the app is (at exit, after saving received certificates etc.): crypto/bio/bio_lib.c:122: OpenSSL internal error: refcount error Aborted (core dumped)
OpenSSL internal refcount error on BIO_free(ctx->tlsBIO)
simplified error handling of set1_aostr_else_random()
fixed signed/unsigned conversion in write_PKIMESSAGE
fixed signed/unsigned conversion in read_PKIMESSAGE
fixed memory leak w.r.t. all_crls in setup_ctx()
unified naming approach for functions setting callbacks
callback function parameters not documented
fix the const for ctx parameter of transfer function(s)
'snonce' -> 'senderNonce' for consistency with RFC4210 - camelCase should be fine here
improved commmit f2298b4a5a: replaced #ifdef DEBUG by #ifndef NDEBUG
reflected for testing the new semantics of CMP_PKIMESSAGE_check_received()
improved comments and adherence to OpenSSL coding guidelines
fixed various bugs in recent changes to CMP_PKIMESSAGE_check_received()
made test/debug features in cmp.c (opt_reqin, ... opt_respout) dependent on #ifdef DEBUG
reformatting etc. for adherence to OpenSSL coding guidelines for cmp.h
updated docu of CMP_calc_protection() - this should have been part of branch 'sca-fixes'
fixed bug #37 and #56: unified naming for callback functions and types and completed their docu
reformatting etc. for adherence to OpenSSL coding guidelines for cmp_vfy.c and cmp_int.h
corrected typo in field name: whitness -> witness
reformatting etc. for adherence to OpenSSL coding guidelines for cmp_msg.c and cmp_ses.c
reformatting etc. for adherence to OpenSSL coding guidelines for cmp_http.c and cmp_lib.c
Revert "changed type of PKI status from 'long' to 'int', e.g., in CMP_CTX_status_get()"
reformatting etc. for adherence to OpenSSL coding guidelines for cmp_asn.c and cmp_ctx.c
corrected/harmonized return code checking when calling RAND_bytes()
merged CMP_calc_protection_{pbmac,sig} to remove strong overlap
simplified memory management for untrusted certs in ocsp_resp_cb()
fixed potential memory leak on pass_string in load_certstore()
corrected indenting in load_certstore(); fixed potential memory leak in load_untrusted()
fixed potential NULL dereference in check_ocsp_response(); made OCSP_basic_verify() workaround conditional
added return code checking for ENGINE_ctrl() and ENGINE_ctrl_cmd()
satisfy FR#44: certConf callback should be able to override initial check results by lib
changed type of PKI status from 'long' to 'int', e.g., in CMP_CTX_status_get()
declared exchange_certConf() and exchange_error() in cmp_int.h
Output only those certs from extraCerts useful for validating the newly enrolled cert
remember message protection method for caPubs use
Allow re-use of CMP_CTX for further transactions
moved preliminarily inline function declarations from cmp.c to cmp.h
removed duplicate learning of transactionID from CMP_PKIMESSAGE_check_received()
simplified ASN1_OCTET_STRING handling introducing CMP_ASN1_OCTET_STRING_set1() and set1_aostr_else_random()
simplified and generalized interface of CMP_PKIMESSAGE_check_received()
fixed inconsistencies w.r.t. manually adapted autogenerated error reason codes
removed reset of ctx->validatedSrvCert from CMP_CTX_set1_transactionID()
simplified transactionID mgt, removing CMP_PKIHEADER_set1_transactionID() and CMP_PKIHEADER_new_senderNonce()
code in cmp_msg.c now simply relys on CMP_PKIHEADER_init() starting a new transaction when needed
moved TRANSACTIONID_LENGTH and SENDERNONCE_LENGTH to cmp.h
added CLI options to read/write request/response messages for tests and debugging