Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-03 Thread Alex Robuchon
> You don't have to explain the code to me. :-) ^^. Ok. I was also trying to explain what I understood so you can correct me if I'm wrong. Everything is Cristal clear now. Thanks a million. On Sun, 3 Oct 2021, 22:25 Viktor Dukhovni, wrote: > On Sun, Oct 03, 2021 at 09:33:

Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-03 Thread Alex Robuchon
te that code and > never see it again. > I hear you :). On Sun, Oct 3, 2021 at 6:48 PM Viktor Dukhovni wrote: > > On 3 Oct 2021, at 12:33 pm, Alex Robuchon > wrote: > > > > So I suppose openssl skip the part that is supposed to build the chain > when no store is con

Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-03 Thread Alex Robuchon
f code relying on eventmachine so we'll see if we can improve the library or move away from it. Thanks so much for your time, explanation and responsiveness. On Sun, 3 Oct 2021, 17:37 Viktor Dukhovni, wrote: > On Sun, Oct 03, 2021 at 01:54:44PM +0200, Alex Robuchon wrote: > > &g

Re: SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-03 Thread Alex Robuchon
Thanks for the detailed answer. >From strace I can see that I'm using /lib/x86_64-linux-gnu/libssl.so.1.1 When I use the eventmachine lib that uses the wrong cert chain I can see with strace : openat(AT_FDCWD, "/usr/lib/ssl/cert.pem", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/l

SSL_CTX_set_verify uses the "wrong" certificate chain (cross signed certificate )

2021-10-02 Thread Alex Robuchon
Hello Openssl community, I've encountered an issue with em-http-request ( https://github.com/igrigorik/em-http-request) based on top of eventmachine ( https://github.com/eventmachine/eventmachine) since let's encrypt Root certificate expired the 30th of September. The project has a callback functi