diff options
| author | Russ Cox <rsc@golang.org> | 2022-04-27 09:02:53 -0400 |
|---|---|---|
| committer | Russ Cox <rsc@golang.org> | 2022-04-29 14:23:29 +0000 |
| commit | 0184fe5ece4f84fda9db04d2472b76efcaa8ef55 (patch) | |
| tree | 46d2538ae712570da44013bf6301403bbecda4a3 /src/crypto/tls/handshake_client.go | |
| parent | 9e9c7a0aec0f821b54006681d4fdfba8a0cd6679 (diff) | |
| download | go-0184fe5ece4f84fda9db04d2472b76efcaa8ef55.tar.xz | |
[dev.boringcrypto] crypto/x509: remove VerifyOptions.IsBoring
This API was added only for BoringCrypto, never shipped in standard
Go. This API is also not compatible with the expected future evolution
of crypto/x509, as we move closer to host verifiers on macOS and Windows.
If we want to merge BoringCrypto into the main tree, it is best not to
have differing API. So instead of a hook set by crypto/tls, move the
actual check directly into crypto/x509, eliminating the need for
exposed API.
For #51940.
Change-Id: Ia2ae98c745de818d39501777014ea8166cab0b03
Reviewed-on: https://go-review.googlesource.com/c/go/+/395878
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/crypto/tls/handshake_client.go')
| -rw-r--r-- | src/crypto/tls/handshake_client.go | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go index de19b7ede5..e61e3eb540 100644 --- a/src/crypto/tls/handshake_client.go +++ b/src/crypto/tls/handshake_client.go @@ -866,9 +866,7 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error { DNSName: c.config.ServerName, Intermediates: x509.NewCertPool(), } - if needFIPS() { - opts.IsBoring = isBoringCertificate - } + for _, cert := range certs[1:] { opts.Intermediates.AddCert(cert) } |