Cyclic0007/wolfssl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent apple native cert validation from overriding error codes other than ASN_NO_SIGNER_E

Browse Source
This commit is contained in:
Brett
2025-06-04 15:48:15 -06:00
parent 9864959e41
commit bc8eeea703
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/internal.c
View File

@@ -16809,7 +16809,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
/* If we can't validate the peer cert chain against the CAs loaded
* into wolfSSL, try to validate against the system certificates
* using Apple's native trust APIs */
if ((ret != 0) && (ssl->ctx->doAppleNativeCertValidationFlag)) {
if ((ret == ASN_NO_SIGNER_E) &&
(ssl->ctx->doAppleNativeCertValidationFlag)) {
if (DoAppleNativeCertValidation(ssl, args->certs,
args->totalCerts)) {
WOLFSSL_MSG("Apple native cert chain validation SUCCESS");