From 5fccf603ebcf352ba783136d6b2d2600d811fb3b Mon Sep 17 00:00:00 2001 From: Kevin McCarthy Date: Fri, 5 Jun 2020 18:16:31 -0700 Subject: [PATCH] Abort GnuTLS certificate check if a cert in the chain is rejected. GnuTLS is not checking dates because we disabled that in tls_negotiate(). So if we don't do this, rejecting an expired intermediate cert will have no effect. Certstat won't contain an expiration error, and tls_check_preauth() will only look at each subsequent cert in the chain's dates. --- mutt_ssl_gnutls.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mutt_ssl_gnutls.c b/mutt_ssl_gnutls.c index 19d47b3..6f98f50 100644 --- a/mutt_ssl_gnutls.c +++ b/mutt_ssl_gnutls.c @@ -1199,8 +1199,12 @@ static int tls_check_certificate (CONNECTION* conn) rc = tls_check_one_certificate (&cert_list[i], certstat, conn->account.host, i, cert_list_size); + /* Stop checking if the menu cert is aborted or rejected. */ + if (!rc) + break; + /* add signers to trust set, then reverify */ - if (i && rc) { + if (i) { rcsettrust = gnutls_certificate_set_x509_trust_mem (data->xcred, &cert_list[i], GNUTLS_X509_FMT_DER); -- 2.27.0