tree 938ba126e2c3dde7e6d7f4ef6a41e64fbb37c87b
parent 72b095d0d483e6b9df002427054a0b150ee76f49
author David Benjamin <davidben@google.com> 1592234166 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1592238843 +0000

Enforce the keyUsage extension in TLS 1.2 client certs.

I've left this independent of SSL_set_enforce_rsa_key_usage because
client certificates in TLS always use the digitalSignature bit, RSA or
otherwise, so it's less likely that someone has messed it up, unlike
TLS 1.2 RSA server certificates.

Update-Note: Client certificates which do not support the
digitalSignature key usage will be rejected. They should either include
that bit or omit the keyUsage extension.

Bug: 349
Change-Id: I97bbf0c8e394f219ff75b686e0c14019f6d8c9a8
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/41664
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>