Does order matter when verifying an X.509 store?
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Start by reproducing the ordering difference in the linked gist using validate_chain with the two intermediate-CA orders. Read the referenced OpenSSL X509_verify_cert documentation and compare its behavior with PyOpenSSL v23.2.0 and Python v3.7.7. Done means establishing whether the order-dependent result is expected and clearly identifying the relevant issue scope.
Written by the indexing model from the issue text.
Description
I noticed that changing the order of the two intermediate CAs (when one is irrelevant) results in a different verification result:
root_1, chain_1, leaf_1 = generate_chain() # root, intermediate, leaf
root_2, chain_2, leaf_2 = generate_chain()
r0 = validate_chain(leaf_1, [chain_1], root_1) # leaf, intermediates, root
r1 = validate_chain(leaf_1, [chain_1, chain_2], root_1)
r2 = validate_chain(leaf_1, [chain_2, chain_1], root_1)
print(r0, r1, r2) # True True False
I was under the impression that the order that certs are added to an X.509 store did not matter. I also didn't seem to find anything in the OpenSSL documentation about this. Can anyone clarify?
Example (source): https://gist.github.com/kaedenbrinkman/c5f2b7d05034999cd55821a4f3403720
PyOpenSSL v23.2.0, Python v3.7.7
- Dominant language
- Python
- Stars
- 944
- Forks
- 440
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 4
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pyca/pyopenssl
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Similar issues
-
docs pydanty:is-working
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
pydantic/pydantic-ai#8863 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
run-llama/llama_index#23278 ·
Maintainers usually reply within 2 days
-
documentation from-review-extraction github-actions priority: low severity:nit
Difficulty 1/5 Under an hour Newbie friendliness 92/100
LearningCircuit/local-deep-research#6946 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
oracle/langchain-oracle#323 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
tenstorrent/tt-metal#58057 · 1 comment ·
Maintainers usually reply within 1 day