Re: OpenSSL 1.1.1h not detecting expired certs

2020-11-01 Thread Viktor Dukhovni
On Sun, Nov 01, 2020 at 11:16:24AM -0500, Paul Smith wrote: > I have a test in my test suite that constructs an expired self-signed > cert and attempts to use it to connect to the server. When I link my > server with OpenSSL 1.1.1g, it is detected properly and I see in the > log (this is a constr

Re: OpenSSL 1.1.1h not detecting expired certs

2020-11-01 Thread Paul Smith
On Sun, 2020-11-01 at 11:16 -0500, Paul Smith wrote: > Does anyone have any ideas about what I might check to figure out > what's happening here? The release notes discuss enabling > MinProtocol and MaxProtocol; I do not use these and in fact I don't > invoke SSL_CONF_*() at all. Is this an issue

OpenSSL 1.1.1h not detecting expired certs

2020-11-01 Thread Paul Smith
I have a server linked (statically) with OpenSSL 1.1.1g (GNU/Linux, 64bit). I built everything myself, I'm not using any system libraries. I have a test in my test suite that constructs an expired self-signed cert and attempts to use it to connect to the server. When I link my server with OpenSS