<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
I have some questions about my application’s verify_callback() function and how I handle some of the OpenSSL errors.</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
<o:p> </o:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
For example, if my client application is presented a self-signed certificate in the handshake, verify_callback() is called with an error, for which X509_STORE_CTX_get_error() returns 18/X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT. In this case, my application searches
its trusted store for this certificate, and if it finds a match, the error is cleared and the handshake is allow to proceed.
</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
<o:p> </o:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
Other examples are cases where my client application is presented with a certificate chain. Let’s say the chain looks like root -> intermediate -> end-entity, but the server is configured to not send the root, so my client gets: intermediate -> end-entity in
the handshake. </p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
<o:p> </o:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
One case is where my client is presented these <span style="mso-spacerun:yes"> </span>certificates and has the end-entity certificate in its trusted store. In this case, the verify_callback() gets error 20/ X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. For
this error, my application will search its trusted store for the end-entity certificate, and when a match is found the error is cleared and the handshake is allowed to proceed.</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
<o:p> </o:p></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
A slightly different case is when the client has only the intermediate certificate in its trusted store, while the server presents the intermediate -> end-entity chain. In this case, verify_callback() is called with an error, and X509_STORE_CTX_get_error()
returns 2/<span style="mso-ascii-font-family:
Calibri;mso-hansi-font-family:Calibri;mso-bidi-font-family:Calibri"> X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT.
</span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
<span style="mso-ascii-font-family:Calibri;mso-hansi-font-family:
Calibri;mso-bidi-font-family:Calibri"><o:p> </o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif">
These last two cases seem very similar but get slightly different errors. Right now my application does not look for a match in the case of X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT. My plan is to add that error to the cases where the trusted store is searched for
a match. Are there more subtle differences between these two errors that I’m missing? Or does my plan to have the application do the addition checking for this error make sense?</p>
<br>
</div>
</body>
</html>