gnutls-cli: if dane verification is used but not PKIX only check the end certificate.

1 files changed, 7 insertions, 1 deletions

diff --git a/src/cli.c b/src/cli.c
index 140de65f9f..ddf9a832ca 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -461,14 +461,20 @@ static int cert_verify_callback(gnutls_session_t session)
 #ifdef HAVE_DANE
 	if (dane) {		/* try DANE auth */
 		int port;
+		unsigned vflags = 0;
 		unsigned int sflags =
 		    ENABLED_OPT(LOCAL_DNS) ? 0 :
 		    DANE_F_IGNORE_LOCAL_RESOLVER;
 
+		/* if we didn't verify the chain it only makes sense
+		 * to check the end certificate using dane. */
+		if (ca_verify == 0)
+			vflags |= DANE_VFLAG_ONLY_CHECK_EE_USAGE;
+
 		port = service_to_port(service);
 		rc = dane_verify_session_crt(NULL, session, hostname,
 					     udp ? "udp" : "tcp", port,
-					     sflags, 0, &status);
+					     sflags, vflags, &status);
 		if (rc < 0) {
 			fprintf(stderr,
 				"*** DANE verification error: %s\n",