On Thu, Jan 11, 2007, Andrews, Rick wrote: > Thanks, but that doesn't completely answer my question. Let me rephrase: > As OpenSSL is walking up the chain, it looks at a cert's issuer name and > then tries to find a cert in the cert store with that name as a subject > name. In my case, it will find two. Does it just pick the first one (if > so, I imagine that it's non-deterministic which one will be first)? Or > does it expect that it might find more than one, and pick one based on > some criteria? >
If AKID/SKID is present it also uses that as well as issuer name. Extensions are also examined so a certificate whose extensions imply it can't be used for certificate signing wont be used. If more than one certificate matches the relevant criteria then it is non deterministic. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Funding needed! Details on homepage. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
