Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-02 Thread Viktor Dukhovni
On Sat, Oct 02, 2021 at 05:24:26PM +0200, Alex Robuchon wrote: > The project has a callback function registered with SSL_CTX_set_verify > and failed to verify DST Root CA X3 since it expired. That happens when either: * The configured trust store (perhaps not the default system trust

Use of ossl_unused in err.h.in

2021-10-02 Thread Arran Cudbard-Bell
In current master HEAD and 3.0.0 calling ERR_GET_REASON throws the following warning: src/lib/tls/session.c:1323:43: warning: 'ERR_GET_REASON' was marked unused but was used [-Wused-but-marked-unused] while ((ssl_err = ERR_peek_error()) && (ERR_GET_REASON(ssl_err) ==

SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-02 Thread Alex Robuchon
Hello Openssl community, I've encountered an issue with em-http-request ( https://github.com/igrigorik/em-http-request) based on top of eventmachine ( https://github.com/eventmachine/eventmachine) since let's encrypt Root certificate expired the 30th of September. The project has a callback

Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-02 Thread Angus Robertson - Magenta Systems Ltd
> Yes. To make things even more complex, a few sites also have an > older version of R3 that is directly signed by the DST root: > > - leaf <- R3 <- DST Root CA X3 (self-signed) > > but that's far from common at this point. That old R3 root was issued last winter and got installed in

Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-02 Thread Viktor Dukhovni
On Sat, Oct 02, 2021 at 06:21:00PM +0100, Angus Robertson - Magenta Systems Ltd wrote: > > Yes. To make things even more complex, a few sites also have an > > older version of R3 that is directly signed by the DST root: > > > > - leaf <- R3 <- DST Root CA X3 (self-signed) > > > > but