ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
A step‑by‑step diagnostic guide for OpenSSL TLS certificate verification failures. Identify chain, trust store, hostname, and time issues, run targeted commands, and apply fixes without disabling security.
Goal: achieve identical certificate verification results in development and production environments when relying on OpenSSL's default trust store. Constraint: the library's default certificate directory is set at compile time and may differ between machines; if the environment variables SSL_CERT_FILE or SSL_CERT_DIR are defined only in a developer's shell, p
When an HTTP::Server is configured with a TLS context that enables peer verification and requires a client certificate, presenting an expired client certificate causes the TLS handshake to abort. The server raises an OpenSSL::SSL::Error, but the exception does not expose a distinct reason code or message that clearly indicates certificate expiry versus other
X509 Certificate Chain Validation When utilizing X509_V_FLAG_PARTIAL_CHAIN via X509_VERIFY_PARAM_set_flags , OpenSSL allows a certificate chain to be verified as valid if any intermediate CA in the chain is present in the trust store, rather than requiring the root CA. In OpenSSL 3.0 and later, the introduction of the provider-based architecture changes how
openssl