On Thu, Jan 11, 2007, Andrews, Rick wrote: > If I am cross-certifying a root cert with another root cert, and both > roots are in my cert store, then OpenSSL might see an ambiguous chain > when it tries to verify. There would be two possible chains instead of > one. Can OpenSSL handle such a case? I haven't found any documentation > on this. Thanks, >
OpenSSL currently tries to traverse a single certificate path. It doesn't try multiple paths when attempting to find a trusted root. So if the path lookup fails at some point it will produce an error. So two chains instead of one isn't fatal as long as both are complete. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
