> On Jan 19, 2018, at 10:09 PM, Frank Migge <fm@xxxxxxxxxxxx> wrote: > > >> Object 04: X509v3 Extended Key Usage: TLS Web Server Authentication > > This is were I would check first. > > I am not fully sure, but believe that Extended Key Usage should *not* be there. Indeed the intermediate CA should either not have an extendedKeyUsage, or that keyUsage should include the desired "purpose". The handling of the purpose of intermediate certificates was made more uniform in OpenSSL 1.1.0 (whether the certificate is from the cert store or the remote peer is no longer material). This and related changes can affect whether a chain is still valid with 1.1.0 and beyond. -- Viktor. -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
