security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-02 22:46:30 +02:00
Code Activity

sm: Always allow authorityInfoAccess lookup if CRLs are also enabled.

Browse source 
* sm/certchain.c (find_up): Disable external lookups in offline mode.
Always allow AKI lookup if CRLs are also enabled.
--

GnuPG-bug-id: 4898
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2020-04-16 19:05:49 +02:00
parent f5efbd5a11
commit bbb7edb880
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
2 changed files with 19 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
doc/gpgsm.texi
View file

@ -440,9 +440,14 @@ change it.
@itemx --disable-crl-checks
@opindex enable-crl-checks
@opindex disable-crl-checks
By default the @acronym{CRL} checks are enabled and the DirMngr is used
to check for revoked certificates. The disable option is most useful
with an off-line network connection to suppress this check.
By default the @acronym{CRL} checks are enabled and the DirMngr is
used to check for revoked certificates. The disable option is most
useful with an off-line network connection to suppress this check and
also to avoid that new certificates introduce a web bug by including a
certificate specific CRL DP. The disable option also disables an
issuer certificate lookup via the authorityInfoAccess property of the
certificate; the @option{--enable-issuer-key-retrieve} can be used
to make use of that property anyway.
@item --enable-trusted-cert-crl-check
@itemx --disable-trusted-cert-crl-check