<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body smarttemplateinserted="true">
<div id="smartTemplate4-template">
<div id="smartTemplate4-template">There are no stale intermediate
certificates on my computer.<br>
<br>
(This was a fresh install, on a new drive. I should have never
said "upgrade".)<br>
<br>
Also, strace shows that it is looking for the correct CA
certificate (/var/lib/ca-certificates/openssl/4bfab552.0), and
being told that it exists - but with the newer version of
openssl, it never tries to open the CA certificate (the older
version does).<br>
</div>
</div>
<br>
<br>
<br>
<div id="smartTemplate4-quoteHeader">------ Original Message ------<br>
From: Viktor Dukhovni <a class="moz-txt-link-rfc2396E" href="mailto:openssl-users@dukhovni.org"><openssl-users@dukhovni.org></a><br>
Sent: Sun, 18 Nov 2018 01:00:50 -0500<br>
To: Openssl-users <a class="moz-txt-link-rfc2396E" href="mailto:openssl-users@openssl.org"><openssl-users@openssl.org></a><br>
<br>
Subject: Re: [openssl-users] Problem with x509_verify_certificate<br>
</div>
<blockquote type="cite"
cite="mid:96536961-C59D-4EAD-A81D-424C28629244@dukhovni.org">
<pre class="moz-quote-pre" wrap="">Most likely there's a stale (expired) copy of the intermediate certificate in
question in the trust store, but the peer (server) sent an unexpired version
in the handshake. The solution is to remove the stale intermediate from
the trust store.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Nov 17, 2018, at 8:57 PM, Ken <a class="moz-txt-link-rfc2396E" href="mailto:OpenSSL@k-h.us"><OpenSSL@k-h.us></a> wrote:
I use an application, FreeRDP (<a class="moz-txt-link-freetext" href="https://github.com/FreeRDP/FreeRDP">https://github.com/FreeRDP/FreeRDP</a>), which uses x509_verify_certificate to check the validity of a certificate on a RDP server.
Under openSUSE Leap 42.3 (which uses openssl version "1.0.2j-fips 26 Sep 2016") everything works great.
But, when I upgrade to openSUSE Leap 15.0 (which uses openssl version "1.1.0i-fips 14 Aug 2018") I get an error when connecting to servers that use publicly-signed certificates:
Certificate details:
Subject: OU = Domain Control Validated, CN = owa.xxxxx.com
Issuer: C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", OU =<a class="moz-txt-link-freetext" href="http://certs.starfieldtech.com/repository/">http://certs.starfieldtech.com/repository/</a>, CN = Starfield Secure Certificate Authority - G2
Thumbprint: xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
The above X.509 certificate could not be verified, possibly because you do not have
the CA certificate in your certificate store, or the certificate has expired.
Please look at the OpenSSL documentation on how to add a private CA to the store.
Do you trust the above certificate? (Y/T/N)
On both versions, strace shows is it checking for /var/lib/ca-certificates/openssl/4bfab552.0 (which exists, and is the correct CA) - but with openssl version "1.1.0i-fips 14 Aug 2018", it never opens that file. (With openssl version "1.0.2j-fips 26 Sep 2016", it does open/read that file, which it seems like it work need to, in order to find out if it matches the certificate.)
Any idea what changed? (Or, better question, what needs to be changed to make this application work again?)
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
<br>
</body>
</html>