Dear OpenSSL Users, When attempting to validate a TLS client whose cert has a number of EKU purposes including "any" (2.5.29.37.0), but not "Client Authentication" (1.3.6.1.5.5.7.3.2), I am seeing validation fail with X509_V_ERR_INVALID_PURPOSE. Looking at <https://github.com/openssl/openssl/blob/master/crypto/x509v3/v3_purp.c>, particularly the definitions of both the check_purpose_ssl_client() function and the xku_reject() macro, it seems that OpenSSL does not check for the any purpose EKU. One presumes this is a bug? Or am I doing something wrong? Kind regards, -- Alan
