Initialize a context at instantiation time
To maintain a Pythonic API, we need to initialize the store context
object at object instantiation time so that it is possible to modify the
trust store (a legitable use case) after the object is created.
As the store context implementation becomes more featureful, this will
become more important. E.g., when we add support for
`X509_STORE_CTX_get0_param` and X509_STORE_CTX_set0_param` to change
verification parameters, we'll want to do this.
This change also adds a very simple `set_store` method mostly to make
the initialization and modification changes easier to test.
diff --git a/OpenSSL/test/test_crypto.py b/OpenSSL/test/test_crypto.py
index 0aac1e5..ca54176 100644
--- a/OpenSSL/test/test_crypto.py
+++ b/OpenSSL/test/test_crypto.py
@@ -3257,6 +3257,24 @@
self.assertEqual(e.certificate.get_subject().CN, 'intermediate-service')
+ def test_modification_pre_verify(self):
+ """
+ :py:obj:`verify_certificate` can use a store context modified after
+ instantiation.
+ """
+ store_bad = X509Store()
+ store_bad.add_cert(self.intermediate_cert)
+ store_good = X509Store()
+ store_good.add_cert(self.root_cert)
+ store_good.add_cert(self.intermediate_cert)
+ store_ctx = X509StoreContext(store_bad, self.intermediate_server_cert)
+ e = self.assertRaises(X509StoreContextError, store_ctx.verify_certificate)
+ self.assertEqual(e.args[0][2], 'unable to get issuer certificate')
+ self.assertEqual(e.certificate.get_subject().CN, 'intermediate')
+ store_ctx.set_store(store_good)
+ self.assertEqual(store_ctx.verify_certificate(), None)
+
+
class SignVerifyTests(TestCase):
"""