Thanks, but that doesn't completely answer my question. Let me rephrase: As OpenSSL is walking up the chain, it looks at a cert's issuer name and then tries to find a cert in the cert store with that name as a subject name. In my case, it will find two. Does it just pick the first one (if so, I imagine that it's non-deterministic which one will be first)? Or does it expect that it might find more than one, and pick one based on some criteria?
-Rick > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dr. Stephen Henson > Sent: Thursday, January 11, 2007 11:13 AM > To: [email protected] > Subject: Re: Question about ambiguous cert chains > > On Thu, Jan 11, 2007, Andrews, Rick wrote: > > > If I am cross-certifying a root cert with another root > cert, and both > > roots are in my cert store, then OpenSSL might see an > ambiguous chain > > when it tries to verify. There would be two possible chains > instead of > > one. Can OpenSSL handle such a case? I haven't found any > documentation > > on this. Thanks, > > > > OpenSSL currently tries to traverse a single certificate > path. It doesn't try multiple paths when attempting to find a > trusted root. So if the path lookup fails at some point it > will produce an error. > > So two chains instead of one isn't fatal as long as both are complete. > > Steve. > -- > Dr Stephen N. Henson. Email, S/MIME and PGP keys: see > homepage OpenSSL project core developer and freelance consultant. > Funding needed! Details on homepage. > Homepage: http://www.drh-consultancy.demon.co.uk > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > Development Mailing List [email protected] > Automated List Manager [EMAIL PROTECTED] > ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
