After I posted the question I found the earlier discussion from this year: http://www.mail-archive.com/[email protected]/msg66377.html
Following the thread back at least indicates that I'm not the first one who made the incorrect assumption that providing an intermediate certificate as a "trusted" certificate was sufficient. The one issue for us is that we're attempting to bridge the windows certificate store and the openssl verification machinery. (We implement for several platforms so openssl is used in common with the windows crypto api/certificate store used to retrieve the certificates.) I can certainly load "chains" of certificates manually but this seems like an instance where the capi engine could be useful. Unfortunately I never found sufficient documentation to use the capi engine to interface windows and openssl due to the associated development schedule. This sounds like a well-defined small problem that could benefit from it though; are there any examples around of the capi engine used to retrieve certificates "as required" from a windows certificate store to do this kind of certificate verification? (i.e. a windows " method that finds them dynamically") Thanks to Dave for the response ... N --- Nou Dadoun [email protected] 604-628-1215 -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Dave Thompson Sent: September 21, 2012 7:37 PM To: [email protected] Subject: RE: Intermediate certificate verification > From: [email protected] On Behalf Of Nou Dadoun > Sent: Friday, 21 September, 2012 15:29 > Just wanted to confirm an assumption, I've got 3 x509 certificates: > > Root --> intermediate --> leaf > > I load the intermediate certificate (but not the Root > certificate) into the x509_store and set up the verify_ctx to > verify the leaf certificate. > > I then use the "X509_verify_cert(verify_ctx)" function for > verification but the associated callback reports that the > verification fails (i.e. ok == 0) with an error of 2 ("unable > to get issuer certificate"). > > I assume that if I load the intermediate as a CA that I don't > have to provide the Root to verify the leaf (i.e. I'm stating > that I trust the intermediate as the CA). Is this correct? > Does the Root also need to be loaded? > No and sort-of. OpenSSL's cert_verify logic always checks to the root, even if an intermediate cert is in the truststore. Unlike some other implementations/applications. It's arguable if this is the best way, but it has been this way since at least 0.9.7, and I wouldn't hold my breath expecting a change soon. The full chain including root needs to be *available from* the X509_STORE. This can be accomplished by having them loaded, or by having a method that finds them dynamically -- like the by_dir method invoked by commandline for -CApath . > This setup certainly works with 2 certs (i.e. Root --> Leaf) > but I'm retrieving the certs using the windows crypto api so > I want to make sure that my openssl verify assumption is > correct before trying to run down the windows stuff. > > Anybody know offhand? Thanks .. N > ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
