Ignore X509_V_ERR_AKID_SKID_MISMATCH

[vcsjones]

OpenSSL 3 started reporting X509_V_ERR_AKID_SKID_MISMATCH when building an X.509 chain that had mismatched AKID/SKIDs.
Previously, this resulted in a PartialChain. This changes the verify callback to ignore X509_V_ERR_AKID_SKID_MISMATCH, and let PartialChain be what ends up getting reported. This is consistent with OpenSSL 1.x.

Closes #67304

[ghost]

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

OpenSSL 3 started reporting X509_V_ERR_AKID_SKID_MISMATCH when building an X.509 chain that had mismatched AKID/SKIDs.
Previously, this resulted in a PartialChain. This changes the verify callback to ignore X509_V_ERR_AKID_SKID_MISMATCH, and let PartialChain be what ends up getting reported. This is consistent with OpenSSL 1.x.

Closes #67304

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[omajid]

Does this affect 6.0 as well? Will we (or should we) backport the fix?

[vcsjones]

Does this affect 6.0 as well?

Possibly.

Will we (or should we) backport the fix?

As someone who has absolutely no authority on back porting, I think we should, if anything so that our release/6.0 tests don't assert if / when they start running on Ubuntu 22.04.

[omajid]

so that our tests don't assert if / when they start running on Ubuntu 22.04.

I am running tests with the 6.0 branch too on RHEL 9 (OpenSSL 3.0). For some reason, I don't see a test failure there. The test error only appears on main.

[vcsjones]

Hm. I wonder if this is another result of #65860. Let me see if that PR introduced this regression.

[omajid]

For some reason, I don't see a test failure there. The test error only appears on main.

That was a PEBKAC. I was building tests, but not running them 🤦

[vcsjones]

@omajid actually I think you are right, this doesn't reproduce for me on 3f26873, but does 07eab2b. I think this is a recent regression against OpenSSL 3.0. I'm going to close this for now, as this might be fixing a symptom and not a root cause. I will re-open it pending discussion on the tracking issue.