[gnutls-devel] GnuTLS | Policy Mappings Critical Identification (#1643)

[Read-only notification of GnuTLS library development activities]

dulanshuangqiao created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1643



## Description of problem:
Gnutls verification failed with a policy map marked as critical
openssl verification passed with a policy map marked as critical
RFC5280 states:This extension MAY be supported by CAs and/or applications. Conforming CAs SHOULD mark this extension as critical.


## Version of gnutls used:
gnutls-cli 3.7.3

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
Ubuntu

## How reproducible:

Steps to Reproduce:

 * one certtool --verify --load-ca-certificate RootCA.pem --infile Cert1732784232101M2.pem
 * two openssl verify -CAfile RootCA.pem Cert1732784232101M2.pem

[Cert1732784232101M2.pem](/uploads/581e0c336700905790aa14f6032f7f06/Cert1732784232101M2.pem)

[RootCA.pem](/uploads/f94a40431d9580b04f537dd9f530a799/RootCA.pem)

## Actual results:
OpenSSL:Cert1732784232101M2.pem: OK

GnuTLS:Not verified. The certificate is NOT trusted. The certificate contains an unknown critical extension. 

## Expected results:

GnuTLS：Verified. The certificate is trusted.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1643
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20250106/c14d4ab8/attachment-0001.html>