search

netflixmedia / pathfinder-pki

Automatically exported from code.google.com/p/pathfinder-pki
2 stars 0 forks source link

Problematic CA practices: TLS-provided chains and missing links in AIA #32

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago 
What steps will reproduce the problem?
1. Try tp validate paypal.com certificate with standard Mozilla certificate
bundle

What is the expected output? What do you see instead?
Certificate is NOT ok. Error: Couldn't build path.  Check the logs to find
out why..
cannot build path to parent certificate
The problematic certificate is
http://EVSecure-aia.verisign.com/EVSecure2006.cer
it refers to "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c)
2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public
Primary Certification Authority - G5" issuer, but provides no information
where to get it.

What version of the product are you using? On what operating system?
r224, RHEL5

Please provide any additional information below.
Actually the missing intermediate CA is provided within TLS session. But as
Pathfinder deals with single certificate only, it cannot validate the
chain. So we need an API for chain validation..

Original issue reported on code.google.com by arke...@gmail.com on 30 Apr 2010 at 1:37