<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I believe this behavior is common among all supported versions of OpenSSL, but most of my testing has been with OpenSSL 1.0.2, the latest LTS release.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My application using OpenSSL is acting as a server. I have a server certificate configured that has been signed by a self-signed/root certificate, so the chain is only the server certificate and the root certificate. The certificates were created using OpenSSL,
for non-production use only. <span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;">The server application is calling SSL_CTX_use_certificate_file() to load the server cert, residing in /etc/ssl/certs. </span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Depending on what's in /etc/ssl/certs, the handshake behavior will show 1 of 2 things:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<ol>
<li>If only the server certificate (and NOT the self-signed root cert) is in /etc/ssl/certs/, only the server certificate will be presented in the handshake.</li><li>If the server AND self-signed root certificates are in /etc/ssl/certs/, the entire chain will be presented during the handshake. </li></ol>
<div>My questions deal with #2: Why does OpenSSL include the root cert in the certificate chain? Will the root cert be included in the chain any time it's in the same directory as the server cert? Is there a way, via API call, configuration, etc, to force OpenSSL
to NOT send the root certificate as part of the chain in this case? Or is there something more basic I'm missing? Googling for answers has not proved fruitful as there are a lot of results, none of which pertain to my situation...although my google fu may
be lacking.</div>
<div><br>
</div>
<div>Thanks in advance.</div>
<div><br>
</div>
</div>
</body>
</html>