Allow intermediate CA certs without keycertsign when added through X509 STORE

ColtonWilley · douzzer · commit 12f4f69fb44a · 2024-10-23T16:55:34.000-05:00
diff --git a/src/ssl.c b/src/ssl.c
@@ -5535,13 +5535,15 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
         }
     }
 
-    if (ret == 0 && cert->isCA == 0 && type != WOLFSSL_USER_CA) {
+    if (ret == 0 && cert->isCA == 0 && type != WOLFSSL_USER_CA &&
+        type != WOLFSSL_INTER_CA) {
         WOLFSSL_MSG("\tCan't add as CA if not actually one");
         ret = NOT_CA_ERROR;
     }
 #ifndef ALLOW_INVALID_CERTSIGN
     else if (ret == 0 && cert->isCA == 1 && type != WOLFSSL_USER_CA &&
-        !cert->selfSigned && (cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) == 0) {
+        type != WOLFSSL_INTER_CA && !cert->selfSigned &&
+        (cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) == 0) {
         /* Intermediate CA certs are required to have the keyCertSign
         * extension set. User loaded root certs are not. */
         WOLFSSL_MSG("\tDoesn't have key usage certificate signing");

Original file line number	Diff line number	Diff line change
`@@ -5535,13 +5535,15 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)`
`5535`	`5535`	`}`
`5536`	`5536`	`}`
`5537`	`5537`
`5538`		`- if (ret == 0 && cert->isCA == 0 && type != WOLFSSL_USER_CA) {`
	`5538`	`+ if (ret == 0 && cert->isCA == 0 && type != WOLFSSL_USER_CA &&`
	`5539`	`+ type != WOLFSSL_INTER_CA) {`
`5539`	`5540`	`WOLFSSL_MSG("\tCan't add as CA if not actually one");`
`5540`	`5541`	`ret = NOT_CA_ERROR;`
`5541`	`5542`	`}`
`5542`	`5543`	`#ifndef ALLOW_INVALID_CERTSIGN`
`5543`	`5544`	`else if (ret == 0 && cert->isCA == 1 && type != WOLFSSL_USER_CA &&`
`5544`		`- !cert->selfSigned && (cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) == 0) {`
	`5545`	`+ type != WOLFSSL_INTER_CA && !cert->selfSigned &&`
	`5546`	`+ (cert->extKeyUsage & KEYUSE_KEY_CERT_SIGN) == 0) {`
`5545`	`5547`	`/* Intermediate CA certs are required to have the keyCertSign`
`5546`	`5548`	`* extension set. User loaded root certs are not. */`
`5547`	`5549`	`WOLFSSL_MSG("\tDoesn't have key usage certificate signing");`