PrakashK94

Results 7 comments of PrakashK94

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

In this file libspdm/os_stub/openssllib/openssl/crypto/x509/x509_vfy.c file, static int build_chain(X509_STORE_CTX *ctx); static int check_chain_extensions(X509_STORE_CTX *ctx); The above two function returns 0, thus it doesn't proceed to validate chain.

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

How to fix this then?

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

I found the place where it fails, even after giving the correct buffers in openssllib functions. ``` static int build_chain(X509_STORE_CTX *ctx) This line, returns ok = 0 because of that...

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

Do you have test certificate chain that has been validated with SPDM responder validator tool which uses openssl 1.1.1q?

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

Test certificates are not present in this format right?

libspdm_x509_verify_cert_chain fails with same x509 certificate data with openssl 1.1.1q but pass with openssl 1.1.1l

I checked with this certificate chain after adding the certificate chain header, https://github.com/DMTF/libspdm/blob/main/unit_test/sample_key/ecp384/bundle_responder.certchain.der still it doesn't work. Certificate verification was not passed with LIBSPDM 2.3.0 code base which uses openssl...

Is there a script that uses openssl to verify the certificates in the certificate chain or some tool?

Any other tool available? Have you ever verified it using openssl verify tool? Can you share an example?