<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Ben Kaduk:
<div class=""><br class="">
</div>
<div class="">Do we know the values that are being passed to SSL_CTX_set_Verify_depth() match the -verify_depth argument, or do they differ?</div>
<div class="">If they differ, do identical arguments to the function behave the same in 1.1.0 and 1.0.2?</div>
<div class=""><br class="">
</div>
<div class="">Viktor:</div>
<div class=""><br class="">
</div>
<div class="">What we’re getting at here, is that this appears to be a potentially significant behavioral change. We want to understand it better.<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">--</div>
<div class="">-Todd Short</div>
<div class="">// <a href="mailto:tshort@akamai.com" class="">tshort@akamai.com</a></div>
<div class="">// "One if by land, two if by sea, three if by the Internet."</div>
</div>
</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Apr 3, 2017, at 4:43 PM, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class=""><br class="">
<blockquote type="cite" class="">On Apr 3, 2017, at 4:26 PM, Benjamin Kaduk <<a href="mailto:bkaduk@akamai.com" class="">bkaduk@akamai.com</a>> wrote:<br class="">
<br class="">
There was a fair amount of churn in x509_vfy.c with the inclusion<br class="">
of the DANE stuff and whatnot, so it's not immediately clear to me<br class="">
when this change actually happened. I think there are good<br class="">
arguments for the current 1.1.0 behavior and it doesn't really make<br class="">
sense to try to change back to the historical behavior, but it would<br class="">
be good to know when the change actually happened and that it is/was<br class="">
a known change. Ideally we could also document the different<br class="">
behavior between 1.0.x and 1.1.0 better; any thoughts about where to<br class="">
do so?<br class="">
</blockquote>
<br class="">
<a href="https://www.openssl.org/docs/man1.1.0/apps/verify.html" class="">https://www.openssl.org/docs/man1.1.0/apps/verify.html</a><br class="">
<br class="">
-verify_depth num<br class="">
<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>Limit the certificate chain to num intermediate CA certificates.<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>A maximal depth chain can have up to num+2 certificates, since<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>neither the end-entity certificate nor the trust-anchor<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>certificate count against the -verify_depth limit.<br class="">
<br class="">
https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_verify_depth.html<br class="">
<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>SSL_CTX_set_verify_depth() sets the maximum depth for the<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>certificate chain verification that shall be allowed for ctx.<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>(See the BUGS section.)<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>...<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>BUGS<br class="">
<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>The certificate verification depth set with SSL[_CTX]_verify_depth()<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>stops the verification at a certain depth. The error message<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>produced will be that of an incomplete certificate chain and<br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>not X509_V_ERR_CERT_CHAIN_TOO_LONG as may be expected.<br class="">
<br class="">
The 1.0.2 behaviour was under-documented and somewhat broken. This<br class="">
was fixed in 1.1.0.<br class="">
<br class="">
<br class="">
Unfortunately, the SSL_CTX_set_verify_depth(3) was not brought up to date,<br class="">
contributes welcome:<br class="">
<br class="">
https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_verify_depth.html<br class="">
<br class="">
-- <br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>Viktor.<br class="">
<br class="">
-- <br class="">
openssl-dev mailing list<br class="">
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>