[php-src] Issue #8372: ext/openssl: check_cert() and php_openssl_store_errors do not pick up validation errors

From: Date: Thu, 14 Apr 2022 11:22:30 +0000
Subject: [php-src] Issue #8372: ext/openssl: check_cert() and php_openssl_store_errors do not pick up validation errors
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-240959@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/8372 Author: arekm ### Description The following code: ``` <?php var_dump(openssl_x509_checkpurpose(file_get_contents('a.pem'), X509_PURPOSE_SSL_SERVER)); while ($msg = openssl_error_string()) echo $msg . "<br />\n";" ``` where a.pem is ```` wget https://raw.githubusercontent.com/fuzyll/defcon-vm/master/extras/hfd/server.pem -O a.pem ```` (or any other single certificate file that won't validate; without intermediates etc) Resulted in this output: ``` $ php x.php bool(false) ``` But I expected this output instead: ``` $ php x.php bool(false) error: certificate chain too long (depth 0) ``` (or similar error message). Why this doesn't work currently? Because X509_verify_cert() in check_cert() validation errors need to be picked up by ```` error = X509_STORE_CTX_get_error(csc) X509_verify_cert_error_string(error) X509_STORE_CTX_get_error_depth(csc) ```` which is not done in php ext/openssl internals. ### PHP Version PHP 8.1.4 ### Operating System _No response_

« previous php.bugs (#240959) next »