diff -up openssl-1.1.0-pre6/crypto/asn1/a_verify.c.no-md5-verify openssl-1.1.0-pre6/crypto/asn1/a_verify.c

--- openssl-1.1.0-pre6/crypto/asn1/a_verify.c.no-md5-verify	2016-08-04 16:00:45.000000000 +0200

+++ openssl-1.1.0-pre6/crypto/asn1/a_verify.c	2016-08-08 16:01:38.382424922 +0200

@@ -7,6 +7,9 @@

  * https://www.openssl.org/source/license.html

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

+

 #include <stdio.h>

 #include <time.h>

@@ -129,6 +132,11 @@ int ASN1_item_verify(const ASN1_ITEM *it

         if (ret != 2)

             goto err;

         ret = -1;

+    } else if (mdnid == NID_md5

+               && secure_getenv("OPENSSL_ENABLE_MD5_VERIFY") == NULL) {

+        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,

+                ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);

+        goto err;

     } else {

         const EVP_MD *type;

         type = EVP_get_digestbynid(mdnid);