sbverify: fix verification
no leaf is OK as is expired cert.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
diff --git a/src/sbverify.c b/src/sbverify.c
index 2e3a75b..4c4b2c6 100644
--- a/src/sbverify.c
+++ b/src/sbverify.c
@@ -199,13 +199,16 @@
&& ctx->cert->ex_xkusage == XKU_CODE_SIGN)
status = 1;
- /* all certs given with the --cert argument are trusted */
else if (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY ||
- err == X509_V_ERR_CERT_UNTRUSTED) {
+ err == X509_V_ERR_CERT_UNTRUSTED ||
+ err == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) {
+ /* all certs given with the --cert argument are trusted */
if (cert_in_store(ctx->current_cert, ctx))
status = 1;
- }
+ } else if (err == X509_V_ERR_CERT_HAS_EXPIRED)
+ /* UEFI explicitly allows expired certificates */
+ status = 1;
return status;
}
