CryptoPkg/BaseCryptLib: Use X509_V_FLAG_NO_CHECK_TIME

[mirror_edk2.git] / CryptoPkg / Library / BaseCryptLib / Pk / CryptPkcs7Verify.c

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index 4d23cbfb945164ba4824e79b5b512f6479ae0e67..fafcf1ba85361c98592e7e304a581a77b9ecee0e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -569,9 +569,10 @@ Pkcs7Verify (
 \r
   //\r
   // Allow partial certificate chains, terminated by a non-self-signed but\r
-  // still trusted intermediate certificate.\r
+  // still trusted intermediate certificate. Also disable time checks.\r
   //\r
-  X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN);\r
+  X509_STORE_set_flags (CertStore,\r
+                        X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
 \r
   //\r
   // OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and\r