Re: [TLS] Verifying X.509 Certificate Chains out of order

[Mike <mike-list at pobox.com>]

> It is a big waste to sort and sort and sort the list each time
> it is processed.  The one who is persisting the data (credential holder)
> can sort it once and for all.

As another data point, my software will first attempt to validate the
certificate chain in the order it was received, but if it finds that
one certificate did not issue the previous one, it then attempts to
put them in the correct order and revalidate the chain.

I had to do this sometime last year because I couldn't connect to one
of the major credit card companies' websites with my own software, but
my browsers were able to.  An additional problem with that site was
their CRL was PEM encoded!

As has been said, be liberal in what you accept....

Mike
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls