{"push_id":638139360,"size":5,"distinct_size":5,"ref":"refs/heads/OpenSSL_1_0_2-stable","head":"47daa155a31b0a54ce09ad2ed4d55fad74096dab","before":"3661bb4e7934668bd99ca777ea8b30eedfafa871","commits":[{"sha":"6281abc79623419eae6a64768c478272d5d3a426","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"In certain situations the server provided certificate chain may no longer be\nvalid. However the issuer of the leaf, or some intermediate cert is in fact\nin the trust store.\n\nWhen building a trust chain if the first attempt fails, then try to see if\nalternate chains could be constructed that are trusted.\n\nRT3637\nRT3621\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/6281abc79623419eae6a64768c478272d5d3a426"},{"sha":"dfd3322d72a2d49f597b86dab6f37a8cf0f26dbf","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add flag to inhibit checking for alternate certificate chains. Setting this\nbehaviour will force behaviour as per previous versions of OpenSSL\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/dfd3322d72a2d49f597b86dab6f37a8cf0f26dbf"},{"sha":"017a06c7d1ed92a5dfbe2586ca96bef268c04895","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add -no_alt_chains option to apps to implement the new\nX509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building\ncertificate chains, the first chain found will be the one used. Without this\nflag, if the first chain found is not trusted then we will keep looking to\nsee if we can build an alternative chain instead.\n\nConflicts:\n\tapps/cms.c\n\tapps/ocsp.c\n\tapps/s_client.c\n\tapps/s_server.c\n\tapps/smime.c\n\tapps/verify.c\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/017a06c7d1ed92a5dfbe2586ca96bef268c04895"},{"sha":"be856c0391d65c8c179721ffa8f35374fddf5892","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add documentation for the -no_alt_chains option for various apps, as well as\nthe X509_V_FLAG_NO_ALT_CHAINS flag.\n\nConflicts:\n\tdoc/apps/cms.pod\n\tdoc/apps/ocsp.pod\n\tdoc/apps/s_client.pod\n\tdoc/apps/s_server.pod\n\tdoc/apps/smime.pod\n\tdoc/apps/verify.pod\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/be856c0391d65c8c179721ffa8f35374fddf5892"},{"sha":"47daa155a31b0a54ce09ad2ed4d55fad74096dab","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Fix verify algorithm.\n\nDisable loop checking when we retry verification with an alternative path.\nThis fixes the case where an intermediate CA is explicitly trusted and part\nof the untrusted certificate list. By disabling loop checking for this case\nthe untrusted CA can be replaced by the explicitly trusted case and\nverification will succeed.\n\nSigned-off-by: Matt Caswell <matt@openssl.org>\n(cherry picked from commit e5991ec528b1c339062440811e2641f5ea2b328b)\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/47daa155a31b0a54ce09ad2ed4d55fad74096dab"}]}