<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/03/2016 23:06, Viktor Dukhovni
wrote:<br>
</div>
<blockquote class=" cite"
id="mid_20160310220622_GH10917_mournblade_imrryr_org"
cite="mid:20160310220622.GH10917@mournblade.imrryr.org"
type="cite">
<pre wrap="">On Thu, Mar 10, 2016 at 10:41:28PM +0100, Jakob Bohm wrote:
</pre>
<blockquote class=" cite" id="Cite_1620018" type="cite">
<blockquote class=" cite" id="Cite_4643013" type="cite">
<pre wrap="">Any ideas what i could be doing wrong?
</pre>
</blockquote>
<pre wrap="">Make sure the intermediary is not included in the "CA storage"
(hashed or single file) used by the client. Anything in that
storage is considered valid and not checked for revocation or
validity.
</pre>
</blockquote>
<pre wrap="">This is changing in OpenSSL 1.1.0, and may yet change in a future
OpenSSL 1.0.2 update. Only the trust-anchor (top-most certificate
from the trust-store) is not checked for expiration or revocation
in OpenSSL 1.1.0.
Intermediate certificates are checked, whether they are from the
trust-store, or acquired from the peer. To get previous behaviour,
one needs to set the X509_V_FLAG_PARTIAL_CHAIN flag so that the
first certificate found in the trust store becomes the trust-anchor,
and chain construction stops there.
Another way (in OpenSSL 1.1.0) to get an intermediate certificate
to terminate the chain is to decorate it with explicit auxiliary
trust EKUs via the "-trustout" and "-addtrust" options of "openssl
x509", and then add the decorated certificate to the trust store.
</pre>
</blockquote>
<tt>This will cause a lot of grief when both OpenSSL versions <br>
are used on the same system, (since 1.1.0 is not a drop in <br>
replacement for OpenSSL 1.0.x), with the same default trust <br>
store directory.</tt><tt><br>
</tt><tt><br>
</tt><tt>It would have been much better to use a separate directory
<br>
for untrusted chain-building intermediary certificates, just <br>
like some other libraries do.<br>
</tt><tt></tt><br>
<tt>This is unlike the hash algorithm change between 0.9.8 and
1.0.x, <br>
since double hashing the shared trust store solved that issue <br>
completely.</tt><br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="https://www.wisemo.com">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>