[openssl-dev] [openssl.org #4620] OCSP_basic_verify() question/comment

[Page, Greg via RT]

Hello!


I have been using openssl to get OCSP status for a certificate and I ran across an interesting case.


OCSP responses do not seem to include the intermediate certificates so they have to be acquired in other ways. I have been doing this and adding them to the certificate stack handed to OCSP_basic_verify().


However, I have noticed that these certificates are not used in creating a certificate chain back to a root CA because they are not added to the X509_STORE_CTX that is sent to X509_verify_cert() and X509_STORE_CTX_get1_chain().


I am relatively new to this so I may be incorrect; however, it seems to me that the certificates in the cert argument should be added to the X509_STORE_CTX.


What are your thoughts?


Thanks,

Greg

[Salz, Rich via RT]

Post by Page, Greg via RT
OCSP responses do not seem to include the intermediate certificates so they
have to be acquired in other ways. I have been doing this and adding them
to the certificate stack handed to OCSP_basic_verify().

Perhaps adding them to X509_STORE or STORE_CTX directly?

Post by Page, Greg via RT
I am relatively new to this so I may be incorrect; however, it seems to me
that the certificates in the cert argument should be added to the
X509_STORE_CTX.

If you need to add certificates to validate a chain, it seems safer to explicitly add them to the store, not implicitly.