<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/03/2016 03:27, Viktor Dukhovni
wrote:<br>
</div>
<blockquote class=" cite"
id="mid_20160311022757_GM10917_mournblade_imrryr_org"
cite="mid:20160311022757.GM10917@mournblade.imrryr.org"
type="cite">
<pre wrap="">On Fri, Mar 11, 2016 at 02:44:59AM +0100, Jakob Bohm wrote:
</pre>
<blockquote class=" cite" id="Cite_3830380" type="cite">
<blockquote class=" cite" id="Cite_2602232" type="cite">
<pre wrap="">Well, no, 1.0.2 uses the trust store not only for trust-anchors,
but also as a capricious source of intermediate certificates, whose
behaviour varies depending on whether the peer supplied same said
certificates on the wire or not. I expect to improve the capricious
behaviour.
</pre>
</blockquote>
<pre wrap="">You keep dodging the question: Does 1.0.2g trust or not
trust intermediary certs found in the "CA" store?
</pre>
</blockquote>
<pre wrap="">They are not trust-anchors, so absent an issuer higher up, they
are not sufficient to establish a "chain of trust", unless the
application enables "partial chain" support.</pre>
</blockquote>
<tt>Ok, that reverses the fundamental assumption behind all my <br>
previous posts (including post #2 in this thread). Why didn't <br>
you state this earlier.<br>
<br>
</tt>
<blockquote class=" cite"
id="mid_20160311022757_GM10917_mournblade_imrryr_org"
cite="mid:20160311022757.GM10917@mournblade.imrryr.org"
type="cite">
<pre wrap="">...
</pre>
<blockquote class=" cite" id="Cite_8485547" type="cite">
<pre wrap="">An intermediate-CApath store would typically act as a
growing cache of encountered intermediaries, needing a
lot less security considerations than a trusted-CApath.
This is especially useful with protocols and protocol
variants where the convention is to not send the full
certificate chain at all, but rather to expect the
opposing end to request (and cache) any missing
intermediaries as necessary.
</pre>
</blockquote>
<pre wrap="">Fine for browsers, not so practical for OpenSSL which does not go
around downloading certificates on the fly.
</pre>
</blockquote>
<tt>Actually, I have only seen this done in non-browser <br>
use of TLS (and only by Microsoft).</tt><br>
<br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="https://www.wisemo.com">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>