Subject: stumped by SKID/AKID mistmatch ... advice?

From: Richard <[email-masked]>
Date: Wed, 16 Aug 2006 15:42:32 -0700

hi all,

i'm fairly sure "i'm close", but am currently stymied trying to figure
out a 'mismatch' error.  i've googled, read the openssl man, read thru a
bunch of this list (e.g.,
http://www.imc.org/ietf-pkix/old-archive-03/msg01181.html), read the
draft spec (e.g.,
http://www3.ietf.org/proceedings/03nov/I-D/draft-ietf-pkix-certpathbuild-01.txt
 (Certification Path Building)), etc etc.

bottom line, no dice.

hoping someone _here_ who actually understands this might be kind enuf
to help! or, at least, point me to a good resource :-)

i've installed:

	% openssl version
		OpenSSL 0.9.8b 04 May 2006

on OSX 10.4.7.

i've created my "own" CA.

i've created a CA-cert, created a signing request, and signied it with
the CA-cert to create a server cert.

i've organized as:

	% setenv my_CERT_DIR "/var/CERTS"
	% setenv my_CA_CERT  "${my_CERT_DIR}/main.CA.cert.rsa.pem"
	% setenv my_SVR_CERT "${my_CERT_DIR}/mail.testdomain.com.cert.rsa.pem"
	% setenv my_SVR_KEY  "${my_CERT_DIR}/mail.testdomain.com.privkey.rsa.pem"

i've created the usual hash symlinks to trust the CA-cert ...

	% sudo -u ssluser ln -sf ${my_CA_CERT}  `openssl x509 -hash -noout -in
${my_CA_CERT}`.0

and verifying the CA-cert:

	% openssl verify -verbose -issuer_checks -purpose sslserver -CAfile
${my_CA_CERT} ${my_CA_CERT}
		/var/CERTS/main.CA.cert.rsa.pem: OK

all's OK.

however, checking the SVR-cert:

	% openssl verify -verbose -issuer_checks -purpose sslserver -CAfile
${my_CA_CERT} ${my_SVR_CERT}

reports:

	/var/CERTS/mail.testdomain.com.cert.rsa.pem:
	/C=US/ST=CA/L=MyCity/O=MyOrgName/OU=MyOrgName/CN=MyOrgName
CA/emailAddress=[email-masked]
	error 30 at 0 depth lookup:authority and subject key identifier mismatch
	/C=US/ST=CA/L=MyCity/O=MyOrgName/OU=MyOrgName/CN=MyOrgName
CA/emailAddress=[email-masked]
	error 30 at 0 depth lookup:authority and subject key identifier mismatch
	/C=US/ST=CA/L=MyCity/O=MyOrgName/OU=MyOrgName/CN=MyOrgName
CA/emailAddress=[email-masked]
	error 30 at 0 depth lookup:authority and subject key identifier mismatch
	OK

huh ???

checking in "openssl.cnf", i've:

	===============
	...
	[ ca ]
	default_ca        = CA_default
	...
	
	[ CA_default ]
	...
	x509_extensions         = usr_cert
	policy                  = policy_match
	...
	
	[ policy_match ]
	countryName             = match
	stateOrProvinceName     = match
	organizationName        = match
	organizationalUnitName  = optional
	commonName              = supplied
	emailAddress            = optional
	...
	
	[ req ]
	...
	x509_extensions         = v3_ca
	req_extensions          = v3_req
	...
	
	[ usr_cert ]
	basicConstraints=CA:FALSE
	subjectKeyIdentifier=hash
	authorityKeyIdentifier=keyid:always,issuer:always
	...
	
	[ v3_req ]
	basicConstraints = CA:FALSE
	subjectKeyIdentifier=hash
	authorityKeyIdentifier=keyid:always,issuer:always
	keyUsage = nonRepudiation, digitalSignature, keyEncipherment
	...
	
	[ v3_ca ]
	subjectKeyIdentifier=hash
	authorityKeyIdentifier=keyid:always,issuer:always
	basicConstraints = CA:true
	===============

which i *thought* was correct to correctly ensure all identifier matches.

apparently, i'm mistaken :-/

any wisdom/suggestions is much appreciated!

thanks,

richard
- --

/"\
\ /  ASCII Ribbon Campaign
 X   against HTML email, vCards
/ \  & micro$oft attachments

[GPG] OpenMacNews at gmail dot com
fingerprint: 50C9 1C46 2F8F DE42 2EDB  D460 95F7 DDBD 3671 08C6