Re: libressl handling of expired CA certificate

2020-06-01 Thread Allan Streib
Stuart Henderson writes: > The same happens with 6.7 and -current. > > Hopefully this will be improved in libressl, but libressl clients > aren't the only ones who will have problems with this - if you're in > contact with the server admins I would recommend they remove the > expired cert from th

Re: libressl handling of expired CA certificate

2020-06-01 Thread Stuart Henderson
On 2020-06-01, Allan Streib wrote: > Below are two openssl s_client transcripts. First with the original > cert.pem (Verify return code: 10 (certificate has expired)) and second > after I edited cert.pem to remove AddTrust (Verify return code: 0 (ok)). > > So, I thought perhaps the issue described

libressl handling of expired CA certificate

2020-06-01 Thread Allan Streib
I ran into a problem today due to the expiration of the AddTrust External CA Root. This prevented my OpenBSD 6.6 smtpd from sending email through my campus mail-relay host. I was referred to a web page[1] that describes the issue. It claims that some OpenSSL clients do not properly follow trust ch