Dr. Stephen Henson wrote:
> On Sat, Oct 10, 2009, Arno Garrels wrote:
>
>> Hi,
>>
>> VeriSign issued some different CA certificates with the same
>> subject (see below). One of such a pair will always fail with
>> error "X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT".
>> However these certificates are part of the Windows Root Certificate
>> Program: http://support.microsoft.com/?scid=kb%3Ben-us%3B931125
>> My Windows application must support them as well, how to work
>> around this issue?
>
> They also seem to have the same public key as well and they are
> deprecated V1 certificates. At least they aren't MD2.
>
> Can you be more specific about the circumstances of the errors?
I use to import the Windows system certificates into a single CA
PEM file and provide the user a visual certificate manager including
an option to verify a cert. However when certs with the same name are
included in the store one of them fails to verify, OpenSSL.exe verify
gives the same error. I guess it's this code in X509_vfy.c:
[..]
/* we have a self signed certificate */
if (sk_X509_num(ctx->chain) == 1)
{
/* We have a single self signed certificate: see if
* we can find it in the store. We must have an exact
* match to avoid possible impersonation.
*/
ok = ctx->get_issuer(&xtmp, ctx, x);
if ((ok <= 0) || X509_cmp(x, xtmp))
{
ctx->error=X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT;
[..]
>
> With the same key and DNs you shouldn't need to install them both
> anyway: paths should verify with only one installed.
Thanks, did not notice that they have the same public key.
>
>> Why are issuers looked up by subject at all?
>>
>
> Because that's what the standards (X.509, RFC3280 et al) require.
Ah ok, but shouldn't name duplicates be taken into account when
issuers are looked up, even though that might result in worse
performance?
--
Arno Garrels
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
