[openssl-dev] 1.0.1t: CMS => PKCS#7 compatibility tests: signed content DER format, RSA key: verify error

[Claus Assmann]

make test fails on OpenBSD and FreeBSD (8.4):

CMS => PKCS#7 compatibility tests
signed content DER format, RSA key: verify error
*** Error 1 in test (Makefile:330 'test_cms')

more cms.err
Verification failure
34371851688:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:328:Verify error:certificate has expired

Is that a known problem? If it isn't specific to my setup, maybe
it can be fixed for the next release?
--
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev

[Viktor Dukhovni]

> On May 10, 2016, at 11:45 PM, Claus Assmann <ca+ss...@esmtp.org> wrote:
>
> make test fails on OpenBSD and FreeBSD (8.4):
>
> CMS => PKCS#7 compatibility tests
> signed content DER format, RSA key: verify error
> *** Error 1 in test (Makefile:330 'test_cms')
>
> more cms.err
> Verification failure
> 34371851688:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:328:Verify error:certificate has expired
>
> Is that a known problem? If it isn't specific to my setup, maybe
> it can be fixed for the next release?

Some of the certs in the 1.0.x test suite are getting old, and it looks
like some have expired. In "master", I generated new certificates for
various tests with a 100-year lifetime. Though some of the tests may
still be using older certs there too. We'll flush these out as we find
them. Thanks for the report.

--
Viktor.