Dear developers,
when I tried to understand what happens in openssl-0.9.6d/apps/s_cb.c:verify_callback(...) I found this callback to be erroneous. Here is why: a) The depth of the certificate chain is tested only if there are other errors (i.e. ok == 0). b) If there are other errors and the depth is ok then the other error condition is deleted (i.e. ok is set to 1). c) The error conditions checked in the switch statement should lead to ok == 0. Since I do not trust mere deduction, I made some tests. My experiments show that the code doesn't detect certificate chains that are too long. Maybe (some) of the errors are due to cvs artefacts. Is anyone interested in a patch? By the way: since these examples are the best publicly and freely available documentation they should be better. The client says "verify: 0 (ok)" if everything is working smooth while the server says "verify return: 1" in this case... And no matter what happens always a connection is made... Very puzzling. Am I wrong? Cheers Georg ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
