217267 - need a way to verify a pre-generated cert chain

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P2)

Description

[Julien Pierre]

CERT_VerifyCertChain doesn't take a cert chain as part of its input parameters.
Rather, it takes a single CERTCertificate* of the leaf certificate. NSS then
builds a cert chain from that leaf certificate, and verifies it.

In some cases, there are multiple cert chains that match the same leaf
certificate. NSS only explores one chain, the one that it builds automatically.
Unfortunately, there is no way for the application to specify which cert chain
to verify.

We need a new API that takes a CERTCertList* and will try to verify the exact
chain passed in by the application, and not a chain generated automatically by NSS.

The function would have a prototype looking like the following :

SECStatus
CERT_VerifyFixedCertChain(CERTCertDBHandle *handle, CERTCertList *chain,
		     PRBool checkSig, SECCertUsage certUsage, int64 t,
		     void *wincx, CERTVerifyLog *log);

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Julien, will/does the libpkix project solve this?

Comment 2

[Julien Pierre]

Yes. The prototype of the API proposed in bug 294531 already allows this (verifyOnly flag). This API hasn't been implemented, but the guts of libpkix make it easy to do verification separately from chain building.

Comment 3

[Julien Pierre]

This was resolved in 3.12 by Alexei.