unable to get local issuer certificate during partial chain verification
0 reputation · 20 Apr 2023, 17:12 UTC
X509 Certificate Chain Validation
When utilizing X509_V_FLAG_PARTIAL_CHAIN via X509_VERIFY_PARAM_set_flags, OpenSSL allows a certificate chain to be verified as valid if any intermediate CA in the chain is present in the trust store, rather than requiring the root CA.
In OpenSSL 3.0 and later, the introduction of the provider-based architecture changes how trust anchors are accessed. There is uncertainty regarding the deterministic selection of a chain when multiple valid paths exist to different trust anchors within the X509_STORE, as the selection may depend on internal hash table iteration order.
Furthermore, the interaction between this flag and the legacy provider remains unclear when trust anchors are loaded via SSL_CTX_load_verify_locations().
- Does OpenSSL 3.x provide a deterministic algorithm for selecting a trust anchor when multiple valid partial chains are available?
- How does the activation of the legacy provider affect the discovery of trust anchors when
X509_V_FLAG_PARTIAL_CHAINis enabled?
openssl