[FFmpeg-devel] [PATCH v4 04/11] WHIP: X509 cert serial number should be positive.

From: Jack Lau <jacklau1222gm@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Cc: winlin <winlinvip@gmail.com>, Jack Lau <jacklau1222@qq.com>
Subject: [FFmpeg-devel] [PATCH v4 04/11] WHIP: X509 cert serial number should be positive.
Date: Mon, 21 Jul 2025 19:30:15 +0800
Message-ID: <20250721113023.91931-5-jacklau1222@qq.com> (raw)
In-Reply-To: <20250721113023.91931-1-jacklau1222@qq.com>

From: winlin <winlinvip@gmail.com>

See RFC5280 4.1.2.2

Signed-off-by: Jack Lau <jacklau1222@qq.com>
---
 libavformat/tls_openssl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
index a6b358d8f9..778595c721 100644
--- a/libavformat/tls_openssl.c
+++ b/libavformat/tls_openssl.c
@@ -328,7 +328,8 @@ static int openssl_gen_certificate(EVP_PKEY *pkey, X509 **cert, char **fingerpri
         goto enomem_end;
     }
 
-    serial = (int)av_get_random_seed();
+    // According to RFC5280 4.1.2.2, The serial number MUST be a positive integer
+    serial = (int)(av_get_random_seed() & 0x7FFFFFFF);
     if (ASN1_INTEGER_set(X509_get_serialNumber(*cert), serial) != 1) {
         av_log(NULL, AV_LOG_ERROR, "TLS: Failed to set serial, %s\n", ERR_error_string(ERR_get_error(), NULL));
         goto einval_end;
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
