https://issues.shibboleth.net/jira/browse/CPPOST-17

[shibboleth/cpp-xmltooling.git] / xmltooling / security / impl / AbstractPKIXTrustEngine.cpp

diff --git a/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp b/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp
index b98ce39..fdd249c 100644 (file)
--- a/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp
+++ b/xmltooling/security/impl/AbstractPKIXTrustEngine.cpp
@@ -67,7 +67,7 @@ namespace {
             return false;
         }
     #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-        X509_STORE_set_flags(store,X509_V_FLAG_CRL_CHECK_ALL);
+        X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
     #endif
     
         STACK_OF(X509)* CAstack = sk_X509_new_null();
@@ -169,7 +169,7 @@ bool AbstractPKIXTrustEngine::checkEntityNames(
             buf[len] = '\0';
             subjectstr+=buf;
         }
-        log.debugStream() << "certificate subject: " << subjectstr << CategoryStream::ENDLINE;
+        log.debugStream() << "certificate subject: " << subjectstr << logging::eol;
         // The flags give us LDAP order instead of X.500, with a comma plus space separator.
         len=X509_NAME_print_ex(b2,subject,0,XN_FLAG_RFC2253 + XN_FLAG_SEP_CPLUS_SPC - XN_FLAG_SEP_COMMA_PLUS);
         BIO_flush(b2);
@@ -262,8 +262,8 @@ bool AbstractPKIXTrustEngine::validate(
 
     if (criteria && criteria->getPeerName() && *(criteria->getPeerName())) {
         log.debug("checking that the certificate name is acceptable");
-        if (criteria->getUsage()==CredentialCriteria::UNSPECIFIED_CREDENTIAL)
-            criteria->setUsage(CredentialCriteria::SIGNING_CREDENTIAL);
+        if (criteria->getUsage()==Credential::UNSPECIFIED_CREDENTIAL)
+            criteria->setUsage(Credential::SIGNING_CREDENTIAL);
         if (!checkEntityNames(certEE,credResolver,*criteria)) {
             log.error("certificate name was not acceptable");
             return false;