Why does OpenSSL report google's certificate is "self-signed"?

[Peter Sylvester]

On 01/04/2021 16:21, Michael Wojcik wrote:
> Thanks to everyone who responded. You've confirmed my impression:
>
> - There doesn't appear to be any applicable standard which requires or forbids including the root, or even endorses or discourages it).
>
rfc8446  page 65:

    ....  The sender's certificate MUST come in the first
    CertificateEntry in the list.  Each following certificate SHOULD
    directly certify the one immediately preceding it.  Because
    certificate validation requires that trust anchors be distributed
    independently, a certificate that specifies a trust anchor MAY be
    omitted from the chain, provided that supported peers are known to
    possess any omitted certificates.

    Note: Prior to TLS 1.3, "certificate_list" ordering required each
    certificate to certify the one immediately preceding it; however,
    some implementations allowed some flexibility.  Servers sometimes
    send both a current and deprecated intermediate for transitional
    purposes, and others are simply configured incorrectly, but these
    cases can nonetheless be validated properly.  For maximum
    compatibility, all implementations SHOULD be prepared to handle
    potentially extraneous certificates and arbitrary orderings from any
    TLS version, with the exception of the end-entity certificate which
    MUST be first.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20210401/1bb47bd5/attachment.html>