• David Howells's avatar
    X.509: Allow X.509 certs to be blacklisted · 43652956
    David Howells authored
    Allow X.509 certs to be blacklisted based on their TBSCertificate hash.
    This is convenient since we have to determine this anyway to be able to
    check the signature on an X.509 certificate.  This is also what UEFI uses
    in its blacklist.
    
    If a certificate built into the kernel is blacklisted, something like the
    following might then be seen during boot:
    
    	X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted
    	Problem loading in-kernel X.509 certificate (-129)
    
    where the hex string shown is the blacklisted hash.
    Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    43652956