<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body smarttemplateinserted="true">
<div id="smartTemplate4-template">Are you saying to test with
"openssl s_client -connect ..."?<br>
<br>
I don't think I know how to interpret all of the output from that,
but it looked to me like it was saying everything was okay when I
tried it earlier (with no changes).<br>
<br>
I just tried it again with -CApath pointing to an empty directory,
and -CAfile pointing to a new copy of the root CA certificate,
which I just downloaded from the provider - I do not see any
difference in the output.<br>
<br>
Then, I tried again, pointing to an incorrect CA - then I see some
errors: "verify error:num=20:unable to get local issuer
certificate"<br>
</div>
<br>
<br>
<br>
So, it seems to me like, without any changes, s_client -connect says
the certificate is fine, but the application using
x509_verify_certificate thinks something is wrong....<br>
<br>
<br>
<br>
<div id="smartTemplate4-quoteHeader">------ Original Message ------<br>
From: Viktor Dukhovni <a class="moz-txt-link-rfc2396E" href="mailto:openssl-users@dukhovni.org"><openssl-users@dukhovni.org></a><br>
Sent: Mon, 19 Nov 2018 01:23:37 -0500<br>
To: Openssl-users <a class="moz-txt-link-rfc2396E" href="mailto:openssl-users@openssl.org"><openssl-users@openssl.org></a><br>
<br>
Subject: Re: [openssl-users] Problem with x509_verify_certificate<br>
</div>
<blockquote type="cite"
cite="mid:5EE3448B-A095-4CE8-B845-8D258F0EB9F7@dukhovni.org">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Nov 19, 2018, at 1:15 AM, Ken <a class="moz-txt-link-rfc2396E" href="mailto:OpenSSL@k-h.us"><OpenSSL@k-h.us></a> wrote:
There are no stale intermediate certificates on my computer.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
The evidence suggests otherwise.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Also, strace shows that it is looking for the correct CA certificate
(/var/lib/ca-certificates/openssl/4bfab552.0), and being told that it
exists - but with the newer version of openssl, it never tries to open
the CA certificate (the older version does).
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
The newer code uses a "trusted first" policy, which means that the
intermediate certificate comes from the trust store, not the peer.
When it fails to validate (as reported, the failure is verifying
the issuer, not leaf certificate) one can reasonably conclude that
there's something wrong with an intermediate issuer certificate in
the trust store.
You can check by creating a new file that contains just
the expected root CA and nothing else, and setting CAfile to
that, and CApath to an empty directory. Please report the results.
</pre>
</blockquote>
<br>
</body>
</html>