<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks Victor.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I need to look at <span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">X509_VERIFY_PARAM_set_flags()
a little closer, but I think I understand what I need to do. </span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">I
also can't concatenate all my trusted certificates into a single file, there are dozens of certificates in the trusted store. Our users can also manipulate the trusted store, so the trusted certificates will always be in PEM files in /etc/ssl/certs/. </span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">It
sounds like that's not going to hold me back from accomplishing what I need to do though, but I'll pursue this and let the list know if I run into any other issues. </span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">Thanks
again,</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">Jason</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> openssl-users <openssl-users-bounces@openssl.org> on behalf of Viktor Dukhovni <openssl-users@dukhovni.org><br>
<b>Sent:</b> Monday, March 30, 2020 9:19 PM<br>
<b>To:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject:</b> Re: Peer certificate verification in verify_callback</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On Mon, Mar 30, 2020 at 09:02:47PM +0000, Jason Schultz wrote:<br>
<br>
> I won't get into the details of my application as it's complex, but it<br>
> can act as a client or a server. The case we are worried about is<br>
> obviously when it's acting as a client. I thought the standard way of<br>
> dealing with these type of errors was with setting a verify_callback()<br>
> function, which is part of the description below.<br>
<br>
The verify callback is mostly for logging and error reporting. It is<br>
not intended to supplant the built-in verification logic. While it<br>
can be used to ignore some errors, that's generally quite risky and<br>
difficult to do correctly. You should strive to arrange for the<br>
built-in verification to succeed, rather than attempt to work around<br>
the resulting errors when it does not.<br>
<br>
> I set up an X509_STORE object and then cycle through all of the<br>
> certificate files in /etc/ssl/certs/, open them, and call<br>
> PEM_read_X509() to get an X509 (certificate) object and then call<br>
> X509_STORE_add_cert(x509_stor, certificate) to read the certificates<br>
> into my trusted store, X509_store object.<br>
<br>
It would be far simpler to concatenate them into a single CAfile, or use<br>
"c_rehash" to create the symlinks need to make the directory into a<br>
workable CApath. You should not have to manually load them into your<br>
own store, although doing the latter potentially gives you the<br>
opportunity to decorate them with auxiliary trust EKUs.<br>
<br>
<br>
> If the user of this CTX is acting as a client and the server presents<br>
> a certificate chain, and my trusted store has the root, the connection<br>
> will work, as the chain is verified and trusted.<br>
<br>
With the partial chain flag it can also work when the EE cert is present<br>
(verbatim) in the store, or an intermediate CA is present in the store.<br>
<br>
> If the server presents a self-signed certificate, the<br>
> verify_callback() function is invoked with the error<br>
> <br>
> 18/X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT, but if I search for and find the self-signed cert in my trusted store, I clear the error and let the<br>
> connection proceed.<br>
<br>
With 1.0.2 and later, the partial chain flag makes this work-around<br>
unnecessary.<br>
<br>
> The scenario is very similar for the case I asked about, the only difference is I'm presented a 2 certs in a chain, and I have the<br>
> intermediate cert in my store. My understanding was the verify_callback() is the correct place to handle these cases.<br>
<br>
No, it is not.<br>
<br>
> From Victor's response, I don't know what a custom X509_STORE type is<br>
> or how to set one up.<br>
<br>
You're already populating a custom store (though not a store type, which<br>
it does not look like you need since your store is just a directory full<br>
of PEM files).<br>
<br>
> Likewise, I don't know how to use the "partial chain" flag<br>
<br>
See X509_VERIFY_PARAM_set_flags(3).<br>
<br>
> and what API I need to load intermediate certificates into my trusted<br>
> store(other than what I describe above). Because of the way<br>
> certificates are distributed, I can't always rely on having the root<br>
> in the trusted store, so I'll need to trust some intermediate certs,<br>
> provided they are valid, actually signed the end-entity cert, etc.<br>
<br>
You just need to add them to the store, simplest is a CAfile or<br>
a hashed CApath.<br>
<br>
-- <br>
Viktor.<br>
</div>
</span></font></div>
</div>
</body>
</html>