8

I don't understand the openssl output. Running openssl as follows:

#openssl s_client -connect google.com:443 -CAfile cacert.pem < /dev/null

Ultimately all is well in that the end entity's cert was verified OK: Verify return code: 0 (ok)

but what about w/the verify return:1 in the beginning of the output for the intermediates below? What does that mean or what is it's point?

depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2 verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = google.com verify return:1

---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---


10

The verify callback function (used to perform final verification of the applicability of the certificate for the particular use) is passed a field by SSL called the preverify_okay field that indicates whether the certificate chain passed the basic checks that apply to all cases. A 1 means these checks passed.

int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)

The verify_callback function is used to control the behaviour when the SSL_VERIFY_PEER flag is set. It must be supplied by the application and receives two arguments: preverify_ok indicates, whether the verification of the certificate in question was passed (preverify_ok=1) or not (preverify_ok=0).

This is what the verify return:1 is showing.

You can check the code if you want more details:

int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
    {
    [ snip ]
    BIO_printf(bio_err,"verify return:%d\n",ok);
    return(ok);
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.