5

From the man pages:

2 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: unable to get issuer certificate

the issuer certificate of a looked up certificate could not be found. This normally means the list of trusted certificates is not complete.

20 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: unable to get local issuer certificate

the issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found.

I'm not sure if I get that. For me it sounds both quite the same. What do they mean with "looked up certificate" and "untrusted certificate". An untrusted certificate would be any certificate along the chain but the root certificate. A look up certificate could be an externally retreived certificate, like though AuthoritiyInfoAccess. But I'm really not certain here.

Improve this question

1 Answer 1

Reset to default
3

Both error cides are very similar. You can view its usage on crypto/x509/x509_vfy.c line 432 onwards:

if (trust != X509_TRUST_TRUSTED && !bad_chain) {
    if ((chain_ss == NULL) || !ctx->check_issued(ctx, x, chain_ss)) {
        if (ctx->last_untrusted >= num)
            ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
        else
            ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT;
        ctx->current_cert = x;
    } else {
        …
    }
    …
 }

Thus, the only difference between both error codes is whether ctx->last_untrusted was >= num when the untrusted certificate was found.

Here, num holds the number of untrusted certs and last_untrusted the index of the last untrusted cert.

The condition last_untrusted >= num (X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) would be met if a trusted chaing to a certificate in the trust store was not found, whereas X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT seem to happen if a CA matched but the chain validation failed anyway, maybe due a malicious chain but perhaps simply due to a missing intermediate.

Improve this answer
2
  • Thanks for inspecting the code. For me as a greenhorn that'd probably taken years to find the right spot :) I'm still not sure however, if I understand correctly. So num holds the number of untrusted certs, of the chain, hence all certs but the root cert. last_untrusted is the index of the last untrusted certificate of the chain. What would that be? Imagine the server sends you a set of certificates of which you can build two seperate chains and no cert points to a valid root.
    – Hansi
    Commented Dec 4, 2016 at 23:50
  • @Hansi I'm not sure to have completely understood it, either. The descriptions of the variable purposes are taken from openssl comments (I wish there were more!). Take my explanation with a grain of salt☺. num is the size of the chain passed to the verify function. If there are two chains, and alternate chain checking wasn't disabled, it tries to find out another path, discarding the other one, see lines 386-425.
    – Ángel
    Commented Dec 5, 2016 at 0:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .