Re: [TLS] Verifying X.509 Certificate Chains out of order

[Rob Dugal <rdugal at certicom.com>]

Certicom's SSL-C toolkit does verify out of order chains but will generate verification warnings that may be overridden by applications.

> -----Original Message-----
> From: tls-bounces at ietf.org [mailto:tls-bounces at ietf.org] On Behalf Of Peter Gutmann
> Sent: Monday, October 06, 2008 5:45 AM
> To: simon at josefsson.org; tls at ietf.org
> Subject: Re: [TLS] Verifying X.509 Certificate Chains out of order
>
> Simon Josefsson <simon at josefsson.org> writes:
>
> >It is claimed that OpenSSL, IE and Firefox does not enforce the second
> >MUST in the paragraph above, and succeeds in verifying an
> >out-of-sequence chain.  I haven't verified the claim.  It appears as if
> >the OpenSSL developers don't consider their behaviour as a bug (see
> >reply below).
>
> Add cryptlib to the list of implementations that don't care about the order.
> In fact I'd be kinda surprised if anyone (well, apart from GnuTLS) cared about
> cert order.
>
> >What are others opinion on this?  I'm looking for some guidance on
> >whether we should modify our current behaviour.
>
> I'd say modify it, in fact I'm not sure what the rationale for requiring
> ordering was in the original spec, "it's tidier that way" doesn't strike me as
> a good argument :-).
>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS at ietf.org
> https://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls