Re: crypt32(4/5): Add tests for key usage in the base policy

[Paul Vriens]

On 10/21/2009 03:28 AM, Juan Lang wrote:
> --Juan

Hi Juan,

This one introduces some failures on some boxes. Are they indeed missing 
the needed Verisign root certificate as stated in the logs?

Which certificate is that btw? The tests fail on my NT4 box where I see 
several Verisign root certificates.

crypt32(4/5): Add tests for key usage in the base policy

[Paul Vriens]

On 10/22/2009 09:07 AM, Paul Vriens wrote:
> On 10/21/2009 03:28 AM, Juan Lang wrote:
> > --Juan
>
> Hi Juan,
>
> This one introduces some failures on some boxes. Are they indeed missing
> the needed Verisign root certificate as stated in the logs?
>
> Which certificate is that btw? The tests fail on my NT4 box where I see
> several Verisign root certificates.

Could it just be a fact of an older crypt32 that doesn't deal (properly) 
with CERT_TRUST_IS_NOT_VALID_FOR_USAGE?

All 4 failing tests seem to be missing that 
CERT_TRUST_IS_NOT_VALID_FOR_USAGE for the dwErrorStatus.

crypt32(4/5): Add tests for key usage in the base policy

[Juan Lang]

Hi Paul,
> > This one introduces some failures on some boxes. Are they indeed missing
> > the needed Verisign root certificate as stated in the logs?

No, that warning is spurious in this case.  Austin and I introduced
competing patches for this one, where my warning was intended to warn
only in the case that no root certificates were found, hence would not
produce spurious warnings.  His was simpler and beat mine.
> Could it just be a fact of an older crypt32 that doesn't deal (properly)
> with CERT_TRUST_IS_NOT_VALID_FOR_USAGE?

Yes.  I was hoping to mark these with broken, but I missed it on some
chains.  Does the attached patch help?
--Juan

crypt32(4/5): Add tests for key usage in the base policy

[Paul Vriens]

On 10/22/2009 04:40 PM, Juan Lang wrote:
> Hi Paul,
> > > This one introduces some failures on some boxes. Are they indeed missing
> > > the needed Verisign root certificate as stated in the logs?
>
> No, that warning is spurious in this case.  Austin and I introduced
> competing patches for this one, where my warning was intended to warn
> only in the case that no root certificates were found, hence would not
> produce spurious warnings.  His was simpler and beat mine.
> > Could it just be a fact of an older crypt32 that doesn't deal (properly)
> > with CERT_TRUST_IS_NOT_VALID_FOR_USAGE?
>
> Yes.  I was hoping to mark these with broken, but I missed it on some
> chains.  Does the attached patch help?
> --Juan

Yep, that fixes it on at least my Win98 box.

Thanks.