[gnutls-devel] GnuTLS | Differences in certificate verification results (#1642)

[Read-only notification of GnuTLS library development activities]

dulanshuangqiao created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1642



## Description of problem:
GnuTLS has different results than OpenSSL when performing certificate verification. According to RFC5280 and the content of the test case itself, I think it is a gnutls verification error.
RFC5280 states: When the keyUsage extension appears in a certificate, at least one of the bits MUST be set to 1.
The keyusage value of this test case is empty, that is, there is no bit set to 1.

## Version of gnutls used:
gnutls-cli 3.7.3

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
Ubuntu

## How reproducible:

Steps to Reproduce:

 * one certtool --verify --load-ca-certificate RootCA.pem --infile Cert1732784164244D1.pem 
 * two openssl verify -CAfile RootCA.pem Cert1732784164244D1.pem

## Actual results:
openssl：error:1100009E:X509 V3 routines:ossl_x509v3_cache_extensions:invalid certificate
gnutls：Verified. The certificate is trusted.


## Expected results:
gnutls：Not verified. The certificate is NOT trusted.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1642
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20250106/1779c3ce/attachment.html>