> [ Redirecting to openssl-users ] Problem is that if reported is not subscribed to either list, then he won't ever get the message. Whatever comes through <rt> is better passed though <rt>.
> On Fri, Dec 04, 2015 at 03:25:35PM +0000, Oliver Schonrock via RT wrote: > >> To Reproduce: >> $ openssl s_client -connect api.textmarketer.co.uk:443 >> depth=2 C = US, O = "thawte, Inc.", OU = Certification Services >> Division, OU = "(c) 2006 thawte, Inc. - For authorized use only", CN = >> thawte Primary Root CA >> verify error:num=20:unable to get local issuer certificate >> ... > > Despite the CN string, the certificate presented by that server on > the wire is not a root certificate. Well, server is not actually required to send complete chain, it's free to make assumption about root certificate being in client's local store. It's natural assumption and is common place. What happens in this case is that this last root certificate is not present in OS-provided chain, which naturally causes failure to build the chain. This is not OpenSSL problem, but OS configuration. Case is being dismissed. > See the attached chain. > > Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, > OU=Certification Services Division, CN=Thawte Premium Server > CA/[email protected] > Validity > Not Before: Nov 17 00:00:00 2006 GMT > Not After : Dec 30 23:59:59 2020 GMT > Subject: C=US, O=thawte, Inc., OU=Certification Services Division, > OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA > >> The same command on FreeBSD 10.2 (OpenSSL 1.0.1p) results in: >> $ openssl s_client -connect api.textmarketer.co.uk:443 >> depth=2 C = US, O = "thawte, Inc.", OU = Certification Services >> Division, OU = "(c) 2006 thawte, Inc. - For authorized use only", CN = >> thawte Primary Root CA >> verify return:1 > > In 1.0.1p OpenSSL looks in the trust store before consulting the > provided chain. You likely have a better Thawte certificate there > than the one sent by the server. _______________________________________________ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
