I tried the following and it created more interesting results.
It now fails on the good certificate -- the one that matches the
nameConstraint.
The error it returns is:
error 34 at 1 depth lookup:unhandled critical extensionI revised the cnf file to make sure it didn't include the name constraint and ran the test again and it succeeded. I then ran a "verify" on the Sub-CA certificate itself. Even that fails. This shows that either my forumlation of the constraint is wrong or for some other reason, the name constraint is being applied where it shouldn't. The updated script and config file are enclosed. jeff On Fri, 2010-06-04 at 11:20 +0200, Dr. Stephen Henson wrote: > Try this instead: > > openssl verify -CAfile root.pem -untrusted cas.pem badcert.pem > > Where "root.pem" contains the root CA only and "cas.pem" is a concatenation of > any intermediate CAs. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List openssl-users@openssl.org > Automated List Manager majord...@openssl.org This email contains Morega Systems Inc. Privileged and Confidential information.
# OpenSSL configuration file for NameConstraint Test # HOME = . RANDFILE = $ENV::HOME/.rnd [ ca ] default_ca = CA_default [ CA_default ] dir = . new_certs_dir = $dir/ crl_dir = $dir/ database = $dir/index certificate = $dir/rootcacert.pem serial = $dir/serial private_key = $dir/rootcakey.pem RANDFILE = $dir/.rand x509_extensions = cert_ext unique_subject = no name_opt = ca_default cert_opt = ca_default default_crl_days= 30 default_days = 365 default_md = sha1 preserve = no policy = policy_default email_in_dn = no msie_hack = no copy_extensions = none [ policy_default ] countryName = optional stateOrProvinceName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] default_bits = 1024 default_keyfile = ./rootcakey.pem default_md = sha1 prompt = no distinguished_name = root_ca_distinguished_name string_mask = nombstr [ root_ca_distinguished_name ] commonName = Root CA countryName = US [ cert_ext ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always basicConstraints = critical,CA:FALSE keyUsage = critical, keyCertSign, cRLSign extendedKeyUsage=clientAuth [ root_ca_ext ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always keyUsage = critical, keyCertSign, cRLSign basicConstraints = critical,CA:TRUE [ trusted_ca_ext ] # Extensions for the Sub CA subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always keyUsage = critical, keyCertSign, cRLSign basicConstraints = critical,CA:TRUE,pathlen:0 nameConstraints = critical,@name_const_section [ name_const_section ] excluded;dirName=excluded_trust_ca_DN permitted;dirName=permitted_trust_ca_DN [ excluded_trust_ca_DN ] O=bad [ permitted_trust_ca_DN ] O=good
testnameconst.sh
Description: application/shellscript
