tests: updated to account SHA1 move to broken set

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

17 files changed, 47 insertions, 45 deletions

diff --git a/tests/cert-tests/aki b/tests/cert-tests/aki
index 1c72f0d433..e8d39588e3 100755
--- a/tests/cert-tests/aki
+++ b/tests/cert-tests/aki
@@ -36,7 +36,7 @@ if ! test -z "${VALGRIND}"; then
 fi
 
 ${VALGRIND} "${CERTTOOL}" --certificate-info --infile "${srcdir}/data/aki-cert.pem" \
-	|grep -v "Algorithm Security Level" > $TMPFILE
+	|grep -v "Algorithm Security Level"|grep -v ^warning > $TMPFILE
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/cert-tests/certtool-long-oids b/tests/cert-tests/certtool-long-oids
index c2e9559326..c06cf73a31 100755
--- a/tests/cert-tests/certtool-long-oids
+++ b/tests/cert-tests/certtool-long-oids
@@ -36,7 +36,7 @@ if ! test -z "${VALGRIND}"; then
 	VALGRIND="${LIBTOOL:-libtool} --mode=execute ${VALGRIND} --error-exitcode=3"
 fi
 
-${VALGRIND} "${CERTTOOL}" -i --infile "${srcdir}/data/long-oids.pem"|grep -v "Not After:" >$OUTFILE
+${VALGRIND} "${CERTTOOL}" -i --infile "${srcdir}/data/long-oids.pem"|grep -v "Not After:"|grep -v ^warning >$OUTFILE
 rc=$?
 
 if test "${rc}" != 0;then
@@ -44,7 +44,7 @@ if test "${rc}" != 0;then
 	exit 1
 fi
 
-cat "${srcdir}/data/long-oids.pem" |grep -v "Not After:" >${TMPFILE1}
+cat "${srcdir}/data/long-oids.pem" |grep -v "Not After:"|grep -v ^warning >${TMPFILE1}
 $DIFF ${TMPFILE1} ${OUTFILE}
 if test $? != 0;then
 	echo "Error in parsing cert with long OIDs"
diff --git a/tests/cert-tests/name-constraints b/tests/cert-tests/name-constraints
index 9f7e453f36..c28259e25f 100755
--- a/tests/cert-tests/name-constraints
+++ b/tests/cert-tests/name-constraints
@@ -39,7 +39,7 @@ TMPFILE=tmp.$$.pem
 check_for_datefudge
 
 datefudge -s "2016-04-22" \
-	${VALGRIND} "${CERTTOOL}" -e --infile "${srcdir}/data/name-constraints-ip.pem"
+	${VALGRIND} "${CERTTOOL}" --verify-allow-broken -e --infile "${srcdir}/data/name-constraints-ip.pem"
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -55,7 +55,7 @@ if test "${rc}" != "0"; then
 	exit 1
 fi
 
-${DIFF} "${TMPFILE}" "${srcdir}/data/name-constraints-ip2.pem" >/dev/null 2>&1
+${DIFF} -I ^warning "${TMPFILE}" "${srcdir}/data/name-constraints-ip2.pem" >/dev/null 2>&1
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/cert-tests/pathlen b/tests/cert-tests/pathlen
index 7f250e03b4..d532012295 100755
--- a/tests/cert-tests/pathlen
+++ b/tests/cert-tests/pathlen
@@ -37,7 +37,7 @@ fi
 TMPFILE1=ca-no-pathlen-$$.tmp
 TMPFILE2=no-ca-or-pathlen-$$.tmp
 ${VALGRIND} "${CERTTOOL}" --certificate-info --infile "${srcdir}/data/ca-no-pathlen.pem" \
-	|grep -v "Algorithm Security Level" > $TMPFILE1
+	|grep -v "Algorithm Security Level"|grep -v ^warning > $TMPFILE1
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/cert-tests/pem-decoding b/tests/cert-tests/pem-decoding
index b4c2a44120..a31f412b48 100755
--- a/tests/cert-tests/pem-decoding
+++ b/tests/cert-tests/pem-decoding
@@ -96,7 +96,7 @@ fi
 
 cat "${srcdir}/data/xmpp-othername.pem" |grep -v "Not After:" >${TMPFILE1}
 cat ${TMPFILE} |grep -v "Not After:" >${TMPFILE2}
-${DIFF} -I 'Algorithm Security Level' ${TMPFILE1} ${TMPFILE2} || ${DIFF} -I 'Algorithm Security Level' --strip-trailing-cr ${TMPFILE1} ${TMPFILE2}
+${DIFF} -I ^warning -I 'Algorithm Security Level' ${TMPFILE1} ${TMPFILE2} || ${DIFF} -I 'Algorithm Security Level' --strip-trailing-cr ${TMPFILE1} ${TMPFILE2}
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/cert-tests/pkcs1-pad b/tests/cert-tests/pkcs1-pad
index bc859cc31d..8fa341b38f 100755
--- a/tests/cert-tests/pkcs1-pad
+++ b/tests/cert-tests/pkcs1-pad
@@ -46,8 +46,8 @@ TMPFILE2=pkcs1-pad-2.$$.tmp
 
 EXPECT1=2002
 
-datefudge "2006-09-23" "${CERTTOOL}" --verify-chain --infile "${srcdir}/data/pkcs1-pad-ok.pem" | tee $TMPFILE1 >/dev/null 2>&1
-datefudge "2006-09-23" "${CERTTOOL}" --verify-chain --infile "${srcdir}/data/pkcs1-pad-broken.pem" | tee $TMPFILE2 >/dev/null 2>&1
+datefudge "2006-09-23" "${CERTTOOL}" --verify-allow-broken --verify-chain --infile "${srcdir}/data/pkcs1-pad-ok.pem" | tee $TMPFILE1 >/dev/null 2>&1
+datefudge "2006-09-23" "${CERTTOOL}" --verify-allow-broken --verify-chain --infile "${srcdir}/data/pkcs1-pad-broken.pem" | tee $TMPFILE2 >/dev/null 2>&1
 
 out1oks=`grep 'Verified.' $TMPFILE1 | wc -l | tr -d " "`
 out2oks=`grep 'Verified.' $TMPFILE2 | wc -l | tr -d " "`
diff --git a/tests/cert-tests/pkcs7-cat b/tests/cert-tests/pkcs7-cat
index f55c085ab2..0f5b82df12 100755
--- a/tests/cert-tests/pkcs7-cat
+++ b/tests/cert-tests/pkcs7-cat
@@ -38,7 +38,7 @@ OUTFILE=out-pkcs7.$$.tmp
 
 check_for_datefudge
 datefudge -s "2016-10-1" \
-${VALGRIND} "${CERTTOOL}" --p7-verify --inder --infile "${srcdir}/data/pkcs7-cat.p7" --load-ca-certificate "${srcdir}/data/pkcs7-cat-ca.pem" 
+${VALGRIND} "${CERTTOOL}" --verify-allow-broken --p7-verify --inder --infile "${srcdir}/data/pkcs7-cat.p7" --load-ca-certificate "${srcdir}/data/pkcs7-cat-ca.pem" 
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/chainverify-unsorted.c b/tests/chainverify-unsorted.c
index 8dc99bbbd9..f51aff6f23 100644
--- a/tests/chainverify-unsorted.c
+++ b/tests/chainverify-unsorted.c
@@ -603,7 +603,7 @@ void doit(void)
 	gnutls_x509_crt_t *crts;
 	unsigned int crts_size, i;
 	gnutls_x509_trust_list_t tl;
-	unsigned int status, flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN;
+	unsigned int status, flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN|GNUTLS_VERIFY_ALLOW_BROKEN;
 	unsigned int not_flags = GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN;
 
 	/* this must be called once in the program
diff --git a/tests/cve-2008-4989.c b/tests/cve-2008-4989.c
index 1e54115659..c745b99dee 100644
--- a/tests/cve-2008-4989.c
+++ b/tests/cve-2008-4989.c
@@ -202,7 +202,7 @@ int main(int argc, char *argv[])
 	ret = gnutls_x509_crt_list_verify(certs, CHAIN_LENGTH,
 					  &ca, 1,
 					  NULL, 0,
-					  GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
+					  GNUTLS_VERIFY_DISABLE_TIME_CHECKS|GNUTLS_VERIFY_ALLOW_BROKEN,
 					  &verify_status);
 	if (ret < 0) {
 		fprintf(stderr, "gnutls_x509_crt_list_verify[%d]: %s",
diff --git a/tests/dn2.c b/tests/dn2.c
index 9145803923..8732939ac9 100644
--- a/tests/dn2.c
+++ b/tests/dn2.c
@@ -64,7 +64,7 @@ static char pem[] =
     "/do1TDFI0vSl5+M=\n" "-----END CERTIFICATE-----\n";
 
 static const char *info =
-    "subject `CN=www.gmx.de,O=GMX GmbH,street=Frankfurter Ring 129,L=Muenchen,ST=Bavaria,postalCode=80807,C=DE,serialNumber=HRB 144261,businessCategory=V1.0\\, Clause 5.(b),jurisdictionOfIncorporationLocalityName=Muenchen,jurisdictionOfIncorporationCountryName=DE', issuer `CN=VeriSign Class 3 Extended Validation SSL SGC CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US', serial 0x48eca1e3c658be04c547c1eca67a6433, RSA key 1024 bits, signed using RSA-SHA1, activated `2008-11-13 00:00:00 UTC', expires `2009-11-13 23:59:59 UTC', pin-sha256=\"sVjloAiiqTbOeTkJWYtVweNaVPijLP/X95L96gJOSvk=\"";
+    "subject `CN=www.gmx.de,O=GMX GmbH,street=Frankfurter Ring 129,L=Muenchen,ST=Bavaria,postalCode=80807,C=DE,serialNumber=HRB 144261,businessCategory=V1.0\\, Clause 5.(b),jurisdictionOfIncorporationLocalityName=Muenchen,jurisdictionOfIncorporationCountryName=DE', issuer `CN=VeriSign Class 3 Extended Validation SSL SGC CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US', serial 0x48eca1e3c658be04c547c1eca67a6433, RSA key 1024 bits, signed using RSA-SHA1 (broken!), activated `2008-11-13 00:00:00 UTC', expires `2009-11-13 23:59:59 UTC', pin-sha256=\"sVjloAiiqTbOeTkJWYtVweNaVPijLP/X95L96gJOSvk=\"";
 
 void doit(void)
 {
diff --git a/tests/mini-tdb.c b/tests/mini-tdb.c
index cbd7520670..e508eb8b9d 100644
--- a/tests/mini-tdb.c
+++ b/tests/mini-tdb.c
@@ -116,7 +116,7 @@ void doit(void)
 
 	/* verify whether the stored hash verification succeeeds */
 	ret = gnutls_store_commitment(TMP_FILE, NULL, "localhost", "https",
-				      GNUTLS_DIG_SHA1, &hash, 0, 0);
+				      GNUTLS_DIG_SHA1, &hash, 0, GNUTLS_SCOMMIT_FLAG_ALLOW_BROKEN);
 	if (ret != 0) {
 		fail("commitment storage: %s\n", gnutls_strerror(ret));
 		goto fail;
diff --git a/tests/ocsp.c b/tests/ocsp.c
index a3b16041e2..aea1139b8e 100644
--- a/tests/ocsp.c
+++ b/tests/ocsp.c
@@ -110,6 +110,7 @@ static const gnutls_datum_t resp1 =
   "	Extensions:\n" \
   "		Nonce: 16897d913ab525a445fec9fdc2e508a4\n" \
   "	Signature Algorithm: RSA-SHA1\n" \
+  "warning: signed using a broken signature algorithm that can be forged.\n" \
   "	Signature:\n" \
   "		4e:ad:6b:2b:f7:f2:bf:a9:23:1e:3a:0b:06:db:55:53\n" \
   "		2b:64:54:11:32:bf:60:f7:4f:e0:8e:9b:a0:a2:4c:79\n" \
@@ -151,6 +152,7 @@ static const gnutls_datum_t resp2 =
 "		Next Update: Thu Sep 11 06:04:00 UTC 2014\n" \
 "	Extensions:\n" \
 "	Signature Algorithm: RSA-SHA1\n" \
+"warning: signed using a broken signature algorithm that can be forged.\n" \
 "	Signature:\n" \
 "		6e:5e:5e:81:ff:3f:4d:c7:53:c7:1b:f3:d3:1d:dc:9a\n" \
 "		c7:ce:77:2c:67:56:13:98:91:02:01:76:dc:48:b2:1f\n" \
@@ -1449,7 +1451,7 @@ static void resp_verify(void)
 
 	/* check direct verify with signer (should succeed) */
 
-	ret = gnutls_ocsp_resp_verify_direct(resp, signer, &verify, 0);
+	ret = gnutls_ocsp_resp_verify_direct(resp, signer, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify_direct (signer) %d\n", ret);
 		exit(1);
@@ -1462,7 +1464,7 @@ static void resp_verify(void)
 
 	/* check direct verify with cert (should fail) */
 
-	ret = gnutls_ocsp_resp_verify_direct(resp, cert, &verify, 0);
+	ret = gnutls_ocsp_resp_verify_direct(resp, cert, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify_direct (cert) %d\n", ret);
 		exit(1);
@@ -1487,7 +1489,7 @@ static void resp_verify(void)
 		exit(1);
 	}
 
-	ret = gnutls_ocsp_resp_verify(resp, list, &verify, 0);
+	ret = gnutls_ocsp_resp_verify(resp, list, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
 		exit(1);
@@ -1514,7 +1516,7 @@ static void resp_verify(void)
 		exit(1);
 	}
 
-	ret = gnutls_ocsp_resp_verify(resp, list, &verify, 0);
+	ret = gnutls_ocsp_resp_verify(resp, list, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
 		exit(1);
@@ -1541,7 +1543,7 @@ static void resp_verify(void)
 		exit(1);
 	}
 
-	ret = gnutls_ocsp_resp_verify(resp, list, &verify, 0);
+	ret = gnutls_ocsp_resp_verify(resp, list, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
 		exit(1);
@@ -1580,7 +1582,7 @@ static void resp_verify(void)
 		exit(1);
 	}
 
-	ret = gnutls_ocsp_resp_verify(resp, list, &verify, 0);
+	ret = gnutls_ocsp_resp_verify(resp, list, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify (issuer) %d\n", ret);
 		exit(1);
@@ -1640,7 +1642,7 @@ static void long_resp_check(void)
 
 	/* check direct verify with signer (should succeed) */
 
-	ret = gnutls_ocsp_resp_verify_direct(resp, signer, &verify, 0);
+	ret = gnutls_ocsp_resp_verify_direct(resp, signer, &verify, GNUTLS_VERIFY_ALLOW_BROKEN);
 	if (ret < 0) {
 		fail("gnutls_ocsp_resp_verify_direct (signer) %d\n", ret);
 		exit(1);
diff --git a/tests/suite/chain.sh b/tests/suite/chain.sh
index d671aa89e2..d9e04bead7 100755
--- a/tests/suite/chain.sh
+++ b/tests/suite/chain.sh
@@ -50,7 +50,7 @@ while test -d X509tests/test${i}; do
 		find X509tests/test${i} -name I*.crt -print0 |sort -r -z|xargs -n1 --null ${VALGRIND}  "${CERTTOOL}" --certificate-info --inder --infile >> chains/chain${i}.pem 
 	fi
 	find X509tests/test${i} -name T*.crt -print0 |sort -r -z|xargs -n1 --null ${VALGRIND}  "${CERTTOOL}" --certificate-info --inder --infile >> chains/chain${i}.pem 
-	${VALGRIND} "${CERTTOOL}" -e --infile chains/chain${i}.pem > out
+	${VALGRIND} "${CERTTOOL}" --verify-allow-broken -e --infile chains/chain${i}.pem > out
 	rc=$?
 	if test $rc != 0 && test $rc != 1; then
 		echo "Chain ${i} FATAL failure."
diff --git a/tests/suite/crl-test b/tests/suite/crl-test
index 85c40e50fb..2f52c94496 100755
--- a/tests/suite/crl-test
+++ b/tests/suite/crl-test
@@ -44,7 +44,7 @@ if test "${rc}" != "0"; then
 	exit ${rc}
 fi
 
-${DIFF} "${srcdir}/crl/long.pem" "$TMPFILE" || ${DIFF} --strip-trailing-cr "${srcdir}/crl/long.pem" $TMPFILE
+${DIFF} -I ^warning "${srcdir}/crl/long.pem" "$TMPFILE" || ${DIFF} -I ^warning --strip-trailing-cr "${srcdir}/crl/long.pem" $TMPFILE
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/suite/pkcs7-cat b/tests/suite/pkcs7-cat
index 1ddfd6bab1..602e056c68 100755
--- a/tests/suite/pkcs7-cat
+++ b/tests/suite/pkcs7-cat
@@ -38,7 +38,7 @@ check_for_datefudge
 
 #try verification
 datefudge -s "2010-10-10" \
-${VALGRIND} "${CERTTOOL}" --inder --p7-verify --infile "${srcdir}/data/test1.cat" --load-certificate "${srcdir}/data/ca.pem"
+${VALGRIND} "${CERTTOOL}" --verify-allow-broken --inder --p7-verify --infile "${srcdir}/data/test1.cat" --load-certificate "${srcdir}/data/ca.pem"
 rc=$?
 
 if test "${rc}" = "0"; then
@@ -47,7 +47,7 @@ if test "${rc}" = "0"; then
 fi
 
 datefudge -s "2016-10-10" \
-${VALGRIND} "${CERTTOOL}" --inder --p7-verify --infile "${srcdir}/data/test1.cat" --load-certificate "${srcdir}/data/ca.pem"
+${VALGRIND} "${CERTTOOL}" --verify-allow-broken --inder --p7-verify --infile "${srcdir}/data/test1.cat" --load-certificate "${srcdir}/data/ca.pem"
 rc=$?
 
 if test "${rc}" != "0"; then
diff --git a/tests/test-chains.h b/tests/test-chains.h
index 0afde54ed9..d3580824a5 100644
--- a/tests/test-chains.h
+++ b/tests/test-chains.h
@@ -2928,16 +2928,16 @@ static struct
     0,
     GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL, 1412850586},
   { "CVE-2008-4989", cve_2008_4989_chain, &cve_2008_4989_chain[2],
-    0,
+    GNUTLS_VERIFY_ALLOW_BROKEN,
     GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID, NULL},
   { "amazon.com ok", verisign_com_chain_g5, &verisign_com_chain_g5[4],
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_LOW),
+    GNUTLS_VERIFY_ALLOW_BROKEN | GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_LOW),
     0, NULL},
   { "verisign.com v1 fail", verisign_com_chain, &verisign_com_chain[3],
-    0,
+    GNUTLS_VERIFY_ALLOW_BROKEN,
     GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID, NULL},
   { "verisign.com v1 ok", verisign_com_chain, &verisign_com_chain[3],
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_LOW),
+    GNUTLS_VERIFY_ALLOW_BROKEN | GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_LOW),
     0, NULL},
   { "verisign.com v1 not ok due to profile", verisign_com_chain, &verisign_com_chain[3],
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_LEGACY),
@@ -2946,23 +2946,23 @@ static struct
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_HIGH),
     GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL},
   { "citibank.com v1 fail", citibank_com_chain, &citibank_com_chain[2],
-    GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN | GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
   { "expired self signed", pem_self_cert, &pem_self_cert[0],
     0, GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID, NULL},
   { "self signed", pem_self_cert, &pem_self_cert[0],
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS, 0, NULL},
   { "ca=false", thea_chain, &thea_chain[1],
-    0,
+    GNUTLS_VERIFY_ALLOW_BROKEN,
     GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
   { "ca=false2", thea_chain, &thea_chain[1],
-    0, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
   { "hbci v1 fail", hbci_chain, &hbci_chain[2],
-    GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN | GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
   { "hbci v1 ok expired", hbci_chain, &hbci_chain[2],
-    0,
+    GNUTLS_VERIFY_ALLOW_BROKEN,
     GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID, NULL},
   { "hbci v1 ok", hbci_chain, &hbci_chain[2],
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
+    GNUTLS_VERIFY_ALLOW_BROKEN|GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
     0, NULL},
   { "rsa-md5 fail", mayfirst_chain, &mayfirst_chain[1],
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
@@ -2976,7 +2976,7 @@ static struct
   { "rsa-md5 ok", mayfirst_chain, &mayfirst_chain[1],
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5, 0, NULL},
   { "v1ca fail", v1ca, &v1ca[2],
-    GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN|GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT, GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID, NULL},
 
   { "pathlen fail", pathlen_check, &pathlen_check[2],
     GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT | GNUTLS_VERIFY_DISABLE_TIME_CHECKS, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, NULL},
@@ -2994,26 +2994,26 @@ static struct
     GNUTLS_VERIFY_DISABLE_TIME_CHECKS, 0, NULL},
 
   { "v1ca expired", v1ca, &v1ca[2],
-    0,
+    GNUTLS_VERIFY_ALLOW_BROKEN,
     GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID , NULL},
   { "v1ca ok", v1ca, &v1ca[2],
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
+    GNUTLS_VERIFY_ALLOW_BROKEN|GNUTLS_VERIFY_DISABLE_TIME_CHECKS,
     0, NULL},
   { "v1ca2 expired", v1ca, &v1ca[2],
-    GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT,
+    GNUTLS_VERIFY_ALLOW_BROKEN|GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT,
     GNUTLS_CERT_EXPIRED | GNUTLS_CERT_INVALID, NULL},
   { "v1ca2 ok", v1ca, &v1ca[2],
-    GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT,
+    GNUTLS_VERIFY_ALLOW_BROKEN|GNUTLS_VERIFY_DISABLE_TIME_CHECKS | GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT,
     0, NULL},
   { "cacertrsamd5 fail", cacertrsamd5, &cacertrsamd5[2],
     0, GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL},
   { "cacertrsamd5 ok", cacertrsamd5, &cacertrsamd5[2],
-    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5, 0, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN, 0, NULL},
   { "cacertrsamd5 short-cut not ok", cacertrsamd5, &cacertrsamd5[0],
     GNUTLS_VERIFY_DO_NOT_ALLOW_SAME,
     GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL},
   { "cacertrsamd5 short-cut ok", cacertrsamd5, &cacertrsamd5[1],
-    0, 0, NULL},
+    GNUTLS_VERIFY_ALLOW_BROKEN, 0, NULL},
   { "ecc cert ok", ecc_cert, &ecc_cert[1], GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_HIGH), 0, NULL},
   { "ecc cert ok", ecc_cert, &ecc_cert[1], GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_SUITEB128), 0, NULL},
   { "ecc cert not ok (due to profile)", ecc_cert, &ecc_cert[1], GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_ULTRA), 
@@ -3030,7 +3030,7 @@ static struct
   { "name constraints: basic dns intersection", nc_bad4, &nc_bad4[3], 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, NULL, 1412850586},
   { "name constraints: IP in excluded range", nc_bad5, &nc_bad5[2], 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, NULL, 1469540953},
   { "name constraints: 2 constraints (dns, email), non-intuitive order", nc_bad6, &nc_bad6[3], 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, NULL, 1469540953},
-  { "not-modified", modified2, &modified2[3], 0, 0, NULL, 1412850586},
+  { "not-modified", modified2, &modified2[3], GNUTLS_VERIFY_ALLOW_BROKEN, 0, NULL, 1412850586},
   { "kp-interm", kp_fail1, &kp_fail1[3], 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_PURPOSE_MISMATCH, GNUTLS_KP_TLS_WWW_SERVER, 1412850586},
   { "kp-fin", kp_fail2, &kp_fail2[3], 0, GNUTLS_CERT_INVALID | GNUTLS_CERT_PURPOSE_MISMATCH, GNUTLS_KP_TLS_WWW_SERVER, 1412850586},
   { "kp-ok", kp_ok, &kp_ok[3], 0, 0, GNUTLS_KP_OCSP_SIGNING, 1412850586},
diff --git a/tests/x509cert-tl.c b/tests/x509cert-tl.c
index e636ccc0a9..c1a629543a 100644
--- a/tests/x509cert-tl.c
+++ b/tests/x509cert-tl.c
@@ -320,7 +320,7 @@ void doit(void)
 	vdata.size = NAME_SIZE;
 	ret =
 	    gnutls_x509_trust_list_verify_crt2(tl, &server_crt, 1, &vdata, 1,
-						0, &status, NULL);
+						GNUTLS_VERIFY_ALLOW_BROKEN, &status, NULL);
 	if (ret < 0 || status != 0)
 		fail("gnutls_x509_trust_list_verify_crt2 - 1: status: %x\n", status);
 
@@ -340,7 +340,7 @@ void doit(void)
 		fail("gnutls_x509_trust_list_add_trust_dir: %d\n", ret);
 
 	ret =
-	    gnutls_x509_trust_list_verify_crt(tl, &server_crt, 1, 0,
+	    gnutls_x509_trust_list_verify_crt(tl, &server_crt, 1, GNUTLS_VERIFY_ALLOW_BROKEN,
 					      &status, NULL);
 	if (ret < 0 || status != 0)
 		fail("gnutls_x509_trust_list_verify_crt\n");