Hi, I found a bug in openssl ca. If you set authorityKeyIdentifier to keyid and issuer always then the keyid will be set correctly but the issuer is wrong.
Example: Root-CA --> Sub-Level 1 CA --> Sub-Level 2 CA --> User If I issue a certificate for a user then the issuer of the CA-cert is the DN of the Root-CA. I found a problem in two files: crypto/x509v3/v3_akey.c crypto/x509v3/v3_alt.c v3_akey.c uses the following code to set the issuer: if(akeyid->issuer) extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist); I look into v3_alt.c and find the following: STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens, STACK_OF(CONF_VALUE) *ret) { int i; GENERAL_NAME *gen; for(i = 0; i < sk_GENERAL_NAME_num(gens); i++) { gen = sk_GENERAL_NAME_value(gens, i); ret = i2v_GENERAL_NAME(method, gen, ret); } if(!ret) return sk_CONF_VALUE_new_null(); return ret; } The function go to the bottom of the stack which is the Root-CA which is not the issuer of the Sublevel 2 CA-Cert. In my opinion the extension must use the top of the stack. There are two options now: 1. change v3_akey.c gen = sk_GENERAL_NAME_value(akeyid->issuer, 0); extlist = i2v_GENERAL_NAME(NULL, gen, extlist); 2. change v3_alt.c fix the function i2v_GENERAL_NAMES directly STACK_OF(CONF_VALUE) *i2v_GENERAL_NAMES(X509V3_EXT_METHOD *method, GENERAL_NAMES *gens, STACK_OF(CONF_VALUE) *ret) { int i; GENERAL_NAME *gen; gen = sk_GENERAL_NAME_value(gens, 0); ret = i2v_GENERAL_NAME(method, gen, ret); if(!ret) return sk_CONF_VALUE_new_null(); return ret; } The problem is perhaps the usage of i2v_GENERAL_NAMES. I found only one other function which uses this function: i2v_crld in crypto/x509v3/v3_crld.c I think that this function has no problem with the fix (means perhaps there is a similar bug too). Any comments (perhaps my interpretation of the extension is wrong)? Michael -- ------------------------------------------------------------------- Michael Bell Email (private): [EMAIL PROTECTED] Rechenzentrum - Datacenter Email: [EMAIL PROTECTED] Humboldt-University of Berlin Tel.: +49 (0)30-2093 2482 Unter den Linden 6 Fax: +49 (0)30-2093 2959 10099 Berlin Germany http://www.openca.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]