Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2011-01-26 Thread Václav Ovsík
Hello, On Tue, Jan 25, 2011 at 10:57:37PM +0100, Nikos Mavrogiannopoulos wrote: On 01/20/2011 05:58 PM, Václav Ovsík wrote: On Thu, Jan 20, 2011 at 05:22:12PM +0100, Nikos Mavrogiannopoulos wrote: Hello, Indeed I'm mistaken. The reported problem is about order of certificates with the

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2011-01-25 Thread Nikos Mavrogiannopoulos
On 01/20/2011 05:58 PM, Václav Ovsík wrote: On Thu, Jan 20, 2011 at 05:22:12PM +0100, Nikos Mavrogiannopoulos wrote: Hello, Indeed I'm mistaken. The reported problem is about order of certificates with the same subject DN in the repository during verifying certificate. I have server

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2011-01-20 Thread Václav Ovsík
Hi Nikos, On Mon, Dec 20, 2010 at 05:03:28PM +0100, Nikos Mavrogiannopoulos wrote: You cannot reorder certificates on will. For TLS/SSL the certificates have to be ordered (from RFC5246): This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2011-01-20 Thread Nikos Mavrogiannopoulos
On 01/20/2011 05:01 PM, Václav Ovsík wrote: Hi Nikos, On Mon, Dec 20, 2010 at 05:03:28PM +0100, Nikos Mavrogiannopoulos wrote: You cannot reorder certificates on will. For TLS/SSL the certificates have to be ordered (from RFC5246): This is a sequence (chain) of certificates. The sender's

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2011-01-20 Thread Václav Ovsík
On Thu, Jan 20, 2011 at 05:22:12PM +0100, Nikos Mavrogiannopoulos wrote: Hello, Indeed I'm mistaken. The reported problem is about order of certificates with the same subject DN in the repository during verifying certificate. I have server certificates issued by older and newer CA

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2010-12-20 Thread Vaclav Ovsik
Package: libgnutls26 Version: 2.8.6-1 Severity: normal Hi, after renewing intermediate CA certificate of our company CA I can't connect to some servers using ldaps. GnuTLS validation is broken. Renewed CA has the same subject as previous. The certs are accessible at http://www.i.cz/ca/ (Issued by

Bug#607616: libgnutls26: the GnuTLS searches CA certs by subject and stops on first? (fails on more CA with the same subj)

2010-12-20 Thread Nikos Mavrogiannopoulos
You cannot reorder certificates on will. For TLS/SSL the certificates have to be ordered (from RFC5246): This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Gnutls is strict with