Commit e12ed4ebaa for openssl.org

commit e12ed4ebaaf7a56b206bdd39e90f39a531250fa1
Author: Bob Beck <beck@openssl.org>
Date:   Thu Sep 3 17:11:33 2026 -0600

    Make the cached CRL fingerprint internal-only

    Give X509_CRL::fingerprint the same treatment as the certificate one:
    compute it with the built-in SHA-1 via ossl_x509_internal_fingerprint()
    so it does not depend on the CRL's libctx/propq, and drop the
    X509_CRL_digest() shortcut that handed the cached value to callers.
    EXFLAG_NO_FINGERPRINT now only signals an allocation failure; update
    its documentation accordingly.

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Sep 17 16:44:34 2026
    Merged-from: https://github.com/openssl/openssl/pull/32686

diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index e394bfe0d5..3be6654d04 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c
@@ -770,15 +770,6 @@ int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type,
         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
         return 0;
     }
-    if (EVP_MD_is_a(type, SN_sha1)
-        && (data->flags & EXFLAG_SET) != 0
-        && (data->flags & EXFLAG_NO_FINGERPRINT) == 0) {
-        /* Asking for SHA1; always computed in CRL d2i. */
-        if (len != NULL)
-            *len = sizeof(data->fingerprint);
-        memcpy(md, data->fingerprint, sizeof(data->fingerprint));
-        return 1;
-    }
     return ossl_asn1_item_digest_ex(ASN1_ITEM_rptr(X509_CRL), type, (char *)data,
         md, len, data->libctx, data->propq);
 }
diff --git a/crypto/x509/x_crl.c b/crypto/x509/x_crl.c
index 6a1a3778fb..8254aa30ba 100644
--- a/crypto/x509/x_crl.c
+++ b/crypto/x509/x_crl.c
@@ -208,7 +208,8 @@ static int crl_set_issuers(X509_CRL *crl)

 /*
  * The X509_CRL structure needs a bit of customisation. Cache some extensions
- * and hash of the whole CRL or set EXFLAG_NO_FINGERPRINT if this fails.
+ * and the internal-use fingerprint of the whole CRL, or set
+ * EXFLAG_NO_FINGERPRINT if this fails.
  */
 static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
     void *exarg)
@@ -245,7 +246,8 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
         break;

     case ASN1_OP_D2I_POST:
-        if (!X509_CRL_digest(crl, EVP_sha1(), crl->fingerprint, NULL))
+        if (!ossl_x509_internal_fingerprint(ASN1_ITEM_rptr(X509_CRL), crl,
+                crl->fingerprint, sizeof(crl->fingerprint)))
             crl->flags |= EXFLAG_NO_FINGERPRINT;
         crl->idp = X509_CRL_get_ext_d2i(crl, NID_issuing_distribution_point, &i, NULL);
         if (crl->idp == NULL && i != -1) {