Why does OpenSSL's SSL_CTX_load_verify_locations only reads the first cert in a multi cert.pem file
I have a PEM file with many certificates in the form:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
This file contains the certificate of my server, which i intend to connect to over https, and verify
using the boost ssl verify client example listed in the boost source here:
Boost1.62/boost_1_62_0/libs/asio/example/cpp03/ssl/client.cpp03/ssl/client
I am using the load_verify_file call to load up the pem file.
ctx.load_verify_file("mycerts.pem");
But the verification fails with error:
asio.ssl:336134278 : certificate verify failed
The reason i found out is that the program only loads up the first certificate in the pem file above.
The verifcation succeeds when i manually bring up the cert of the server at the top in the pem file.
strace, also tells that only the first -----BEGIN CERTIFICATE----- is read while opening the pem file which does not verify.
The question is that,as per the sources, Boost's load_verify_file() func calls up openssl's:
SSL_CTX_load_verify_locations() func, which by definition, should process each certificate in the provided
multi cert .pem file:
Quoting the openssl doc:
If CAfile is not NULL, it points to a file of CA certificates in PEM
format. The file can contain several CA certificates identified by
-----BEGIN CERTIFICATE----- ... (CA certificate in base64 encoding)
... -----END CERTIFICATE----- sequences. Before, between, and after
the certificates text is allowed which can be used e.g. for
descriptions of the certificates.
The CAfile is processed on execution of the
SSL_CTX_load_verify_locations() function.
I dont seem to understand what i might be missing.
ssl https openssl ssl-certificate boost-asio
asked Nov 20 at 7:26
ashishsony
1,23421831
add a comment |
I have a PEM file with many certificates in the form:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
This file contains the certificate of my server, which i intend to connect to over https, and verify
using the boost ssl verify client example listed in the boost source here:
Boost1.62/boost_1_62_0/libs/asio/example/cpp03/ssl/client.cpp03/ssl/client
I am using the load_verify_file call to load up the pem file.
ctx.load_verify_file("mycerts.pem");
But the verification fails with error:
asio.ssl:336134278 : certificate verify failed
The reason i found out is that the program only loads up the first certificate in the pem file above.
The verifcation succeeds when i manually bring up the cert of the server at the top in the pem file.
strace, also tells that only the first -----BEGIN CERTIFICATE----- is read while opening the pem file which does not verify.
The question is that,as per the sources, Boost's load_verify_file() func calls up openssl's:
SSL_CTX_load_verify_locations() func, which by definition, should process each certificate in the provided
multi cert .pem file:
Quoting the openssl doc:
If CAfile is not NULL, it points to a file of CA certificates in PEM
format. The file can contain several CA certificates identified by
-----BEGIN CERTIFICATE----- ... (CA certificate in base64 encoding)
... -----END CERTIFICATE----- sequences. Before, between, and after
the certificates text is allowed which can be used e.g. for
descriptions of the certificates.
The CAfile is processed on execution of the
SSL_CTX_load_verify_locations() function.
I dont seem to understand what i might be missing.
ssl https openssl ssl-certificate boost-asio
asked Nov 20 at 7:26
ashishsony
1,23421831
1
Did you check theWARNINGSblock in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."
– Blacktempel
Nov 21 at 6:54
add a comment |
I have a PEM file with many certificates in the form:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
This file contains the certificate of my server, which i intend to connect to over https, and verify
using the boost ssl verify client example listed in the boost source here:
Boost1.62/boost_1_62_0/libs/asio/example/cpp03/ssl/client.cpp03/ssl/client
I am using the load_verify_file call to load up the pem file.
ctx.load_verify_file("mycerts.pem");
But the verification fails with error:
asio.ssl:336134278 : certificate verify failed
The reason i found out is that the program only loads up the first certificate in the pem file above.
The verifcation succeeds when i manually bring up the cert of the server at the top in the pem file.
strace, also tells that only the first -----BEGIN CERTIFICATE----- is read while opening the pem file which does not verify.
The question is that,as per the sources, Boost's load_verify_file() func calls up openssl's:
SSL_CTX_load_verify_locations() func, which by definition, should process each certificate in the provided
multi cert .pem file:
Quoting the openssl doc:
If CAfile is not NULL, it points to a file of CA certificates in PEM
format. The file can contain several CA certificates identified by
-----BEGIN CERTIFICATE----- ... (CA certificate in base64 encoding)
... -----END CERTIFICATE----- sequences. Before, between, and after
the certificates text is allowed which can be used e.g. for
descriptions of the certificates.
The CAfile is processed on execution of the
SSL_CTX_load_verify_locations() function.
I dont seem to understand what i might be missing.
ssl https openssl ssl-certificate boost-asio
asked Nov 20 at 7:26
ashishsony
1,23421831
I have a PEM file with many certificates in the form:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
This file contains the certificate of my server, which i intend to connect to over https, and verify
using the boost ssl verify client example listed in the boost source here:
Boost1.62/boost_1_62_0/libs/asio/example/cpp03/ssl/client.cpp03/ssl/client
I am using the load_verify_file call to load up the pem file.
ctx.load_verify_file("mycerts.pem");
But the verification fails with error:
asio.ssl:336134278 : certificate verify failed
The reason i found out is that the program only loads up the first certificate in the pem file above.
The verifcation succeeds when i manually bring up the cert of the server at the top in the pem file.
strace, also tells that only the first -----BEGIN CERTIFICATE----- is read while opening the pem file which does not verify.
The question is that,as per the sources, Boost's load_verify_file() func calls up openssl's:
SSL_CTX_load_verify_locations() func, which by definition, should process each certificate in the provided
multi cert .pem file:
Quoting the openssl doc:
If CAfile is not NULL, it points to a file of CA certificates in PEM
format. The file can contain several CA certificates identified by
-----BEGIN CERTIFICATE----- ... (CA certificate in base64 encoding)
... -----END CERTIFICATE----- sequences. Before, between, and after
the certificates text is allowed which can be used e.g. for
descriptions of the certificates.
The CAfile is processed on execution of the
SSL_CTX_load_verify_locations() function.
I dont seem to understand what i might be missing.
ssl https openssl ssl-certificate boost-asio
ssl https openssl ssl-certificate boost-asio
asked Nov 20 at 7:26
ashishsony
1,23421831
asked Nov 20 at 7:26
ashishsony
1,23421831
asked Nov 20 at 7:26
ashishsony
1,23421831
asked Nov 20 at 7:26
ashishsony
1,23421831
asked Nov 20 at 7:26
ashishsony
1,23421831
1,23421831
1
Did you check theWARNINGSblock in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."
– Blacktempel
Nov 21 at 6:54
add a comment |
1
Did you check theWARNINGSblock in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."
– Blacktempel
Nov 21 at 6:54
1
1
Did you check the
WARNINGS block in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."– Blacktempel
Nov 21 at 6:54
Did you check the
WARNINGS block in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."– Blacktempel
Nov 21 at 6:54
add a comment |
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53388118%2fwhy-does-openssls-ssl-ctx-load-verify-locations-only-reads-the-first-cert-in-a%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53388118%2fwhy-does-openssls-ssl-ctx-load-verify-locations-only-reads-the-first-cert-in-a%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Did you check the
WARNINGSblock in the docs ? -> "If several CA certificates matching the name, key identifier, and serial number condition are available, only the first one will be examined. This may lead to unexpected results if the same CA certificate is available with different expiration dates. If a "certificate expired" verification error occurs, no other certificate will be searched. Make sure to not have expired certificates mixed with valid ones."– Blacktempel
Nov 21 at 6:54