f3a590be69
Release 2.11
...
Signed-off-by: Michał Trojnara <Michal.Trojnara@stunnel.org >
2026-01-20 23:53:33 +01:00
6631a5f10b
Update trusted certificate list
2026-01-20 23:21:33 +01:00
9924f0c085
Minor style improvements
...
- Reorder checks by corresponding RFC 5280 section numbers.
- Simplify comments.
2026-01-20 23:21:33 +01:00
7d85ac5f04
Add GitHub issue and PR templates
2026-01-09 14:41:02 +01:00
feebbcd4d9
Print current CRL during certificate verification
2026-01-07 13:36:43 +01:00
d787541107
tests: add digitalSignature keyUsage to leaf certificate
2025-12-31 11:38:21 +01:00
6390ae2746
Add keyUsage digitalSignature validation for signer certificate
2025-12-31 11:38:21 +01:00
a472d7fbff
Comment returned CRL Content-Type
2025-12-22 19:26:21 +01:00
27172a07ca
Patch CRL fetch failure from expected file type
...
`application/octet-stream` response types caused CRL/TSA-CRL fetch failures
2025-12-22 19:22:01 +01:00
d77ddb9443
Disable keep-alive and remove the shutdown workaround.
...
Some RFC 3161 TSA servers (e.g. time.certum.pl) advertise
"Connection: close" but delay closing the connection,
when keep-alive was requested. The client waited for EOF and
attempted to work around this by explicitly shutting down the socket.
2025-12-19 15:11:12 +01:00
988f72249b
Simplify ASLR/PIE flags check for macOS
2025-12-16 06:42:01 +01:00
c23f92ca68
Improve PKCS#11 and CNG usage instructions in README
2025-09-22 11:16:29 +02:00
842bd94aaf
Remove duplicate certs from sorted X509 chain
2025-09-19 17:02:21 +02:00
1d72c3da8c
Improve key/cert loading logic and standardize usage file argument names
2025-09-19 17:02:21 +02:00
d792e8d0db
Use bio_new_file() wrapper instead of BIO_new_file() for consistent file handling
2025-09-19 17:01:02 +02:00
bbdfc1d98a
Avoid undefined behavior with BIO_get_fp by replacing BIO_new_file with fopen + BIO_new_fp
2025-09-19 17:01:02 +02:00
5ac11e9f58
Fix -Wsign-conversion warning in x509_name_to_utf8()
2025-07-01 12:21:44 +02:00
55541c6ace
Initial 2.11-dev commit
2025-06-23 21:42:26 +02:00
8329a14f8b
Release 2.10
...
Signed-off-by: Michał Trojnara <Michal.Trojnara@stunnel.org >
2025-06-23 21:36:13 +02:00
343b0af1fe
Put globs in quotes
2025-06-23 21:21:34 +02:00
d440f32780
Codespell Action
2025-06-23 21:13:47 +02:00
fb082942d2
Descriptive Action name
2025-06-23 21:05:51 +02:00
025e808c01
docs: fix typos in README
2025-06-20 16:26:18 +02:00
23b6d7782c
docs: fix typo in appx comments
2025-06-20 16:14:25 +02:00
4c3a1e887c
docs: fix typos in README
2025-06-20 16:04:36 +02:00
97ee163e31
Document script file support
2025-06-20 14:06:05 +02:00
dfc3e46a77
Typos
2025-06-20 12:28:43 +02:00
ff9a6d3593
Check for invalid OID in is_content_type
2025-06-20 10:32:30 +02:00
e81b08e02d
Fix a comment
2025-06-20 09:58:45 +02:00
0c85d54800
Handle missing certificate names
2025-06-19 17:56:54 +02:00
772bc22c94
Handle null return from curl_easy_init
2025-06-19 14:32:24 +02:00
d65a2b5286
Fix various typos
2025-06-19 14:18:26 +02:00
a3fcf41e1a
Check memory allocation
2025-06-19 12:00:29 +02:00
e00caac3db
cmake: drop USE_WIN32 define
...
This was added in #423 , but it's only use was then removed in #435 .
2025-06-18 18:46:28 +02:00
dd9b81281f
Support loading OpenSSL 3.0+ providers without -pkcs11module option (e.g., CNG)
2025-06-05 17:13:10 +02:00
6b56aef073
Add tests for handling JavaScript files
2025-06-05 14:41:36 +02:00
52bfff5756
Avoid variable reuse
2025-06-04 18:42:41 +02:00
4d52e9cc4b
JavaScript format fix.
2025-06-04 18:38:28 +02:00
3292b02650
JavaScript support
...
Resolves #437
2025-06-04 10:04:17 +02:00
50c23daa4c
Code simplification
...
No functional change intended.
2025-06-03 08:20:52 +02:00
9b7dae4572
Support loading arbitrary engines via ENGINE_by_id()
...
Use ENGINE_by_id() for any engine name that doesn't contain a dot,
assuming it's an engine ID. If the name includes a dot (e.g., a file
extension), treat it as a path to a dynamic engine module.
See #436 for discussion.
2025-06-02 20:32:26 +02:00
62438908cb
Skip the "lib" prefix when guessing engine ID
...
Fix #436
2025-05-30 16:59:25 +02:00
829e770250
Use _WIN32 instead of USE_WIN32 for MinGW compatibility
2025-05-27 10:17:03 +02:00
a6c7c25dae
Update NEWS
2025-05-14 11:29:13 +02:00
10ca3a06ea
Suppress compiler warnings
2025-05-06 10:42:53 +02:00
9ea7e85468
Fix engine-less builds
2025-05-06 10:42:53 +02:00
68e8845ef1
Improve PKCS#7 verification with OpenSSL 3.5
...
Enhanced verification logic for PKCS#7 signedData structures by introducing a dedicated `verify_pkcs7_data()` function. This update addresses compatibility with older OpenSSL versions (< 3.0.5) and ensures correct handling of detached signed content using a BIO buffer.
The change enables support for PKCS#7 inner content (RFC 2315, section 7), as per OpenSSL PR#22575.
Refactored timestamp and authenticode verification functions to reduce duplication and properly manage X509_STORE and X509_CRL structures.
2025-05-01 11:21:29 +02:00
475ea95ba3
Fix control flow and braces for engine and provider support
2025-05-01 11:21:29 +02:00
d352dcc1a5
Do not try to load engine twice
2025-04-18 10:46:20 +02:00
7734382436
Remove Ubuntu 20.04 from CI as it's no longer supported
2025-04-16 11:48:05 +02:00
Michał Trojnara