[openssl-users] X509_V_ERR_INVALID_PURPOSE when validating TLS client with "any purpose" EKU (2.5.29.37.0)

[Alan Egerton]

Dear OpenSSL Users,

When attempting to validate a TLS client whose cert has a number of
EKU purposes including "any" (2.5.29.37.0), but not "Client
Authentication" (1.3.6.1.5.5.7.3.2), I am seeing validation fail with
X509_V_ERR_INVALID_PURPOSE.

Looking at <https://github.com/openssl/openssl/blob/master/crypto/x509v3/v3_purp.c>,
particularly the definitions of both the check_purpose_ssl_client()
function and the xku_reject() macro, it seems that OpenSSL does not
check for the any purpose EKU.  One presumes this is a bug?

Or am I doing something wrong?

Kind regards,
-- Alan