Where does SSL_CTX_set_verify callback get certificates?

Question

I need to validate a client certificate using OpenSSL. However, I don't have a root certificate (only trusted intermediate certificate).

I started to look around how to do that and found several links:

• http://openssl.6102.n7.nabble.com/Terminate-chain-at-intermediate-certificate-td6815.html

• how to validate a client Certificate using the trusted internediate CA certificate?

Pretty much the summary is "set a callback (using SSL_CTX_set_verify) and ignore errors in this callback".

The callback will be called multiple times (for each certificate in the chain) and the documentation says:

The certificate chain is checked starting with the deepest nesting level (the root CA certificate) and worked upward to the peer's certificate. At each level signatures and issuer attributes are checked.

My question is where does OpenSSL get these certificate chain? Does it get from a client (meaning that they are untrusted) or does it get it from trusted store (meaning that they are trusted).

In the case, if only client cert comes from the client, I can pretty much ignore all errors where depth > 0 (intermediate certs). In this case if a client can send a whole chain then I can't just ignore errors, but rather need to do additional validation.

P.S. My experiment shows that depth=1 is intermediate trusted cert and depth=0 is a certificate which is sent by a client. However, this is inconclusive.

Answer 1

The entire chain comes from the client, and the topmost element in it should be that of a CA that you said you trusted in the CertificateRequest message. Otherwise the client isn't supposed to send anything (possibly an empty chain).

For your purposes any certificate you trust is a root. So all you need to do is ensure the existence of the topmost certificate in your own trusted certificate set, and then proceed with normal validation of the chain.