I've read the great post written by @Thomas Pornin Which properties of a X.509 certificate should be critical and which not?
and it raised my question.
Let's assume that I have a client
C and a server
S. Now, client try to connect to
S presents its certificate
C tries to verify a
S. For that moment we can ommit signature verification and hostname verification details and focus on extensions.
C uses OpenSSL to verify certificate.
But, for some critical extensions OpenSSL says: I don't support that.
What I should do? I suppose that I should writting a code that verifies extensions not supported by OpenSSL, yes?
Especially, how to verify an extension? I can implement it on my own but I have to know what does it mean to verify/validate an extension. Please help.