rsyslog-gnutls can't validate V1 CA certificates

[H.-Dirk Schmitt]

Binary package hint: rsyslog

In my organisation the CA is based on a V1 CA certificate.
This triggers the following error:
 pluto rsyslogd: not permitted to talk to peer, certificate invalid: signer is
not a CA

I can reproduce the problem with gnutls-cli:
   gnutls-cli -V --x509cafile /etc/ssl/certs/proarc-srv.crt -p 42514
pluto.computer42.org
   --> - Peer's certificate issuer is not a CA

If I add '--priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT' to the command above,
the certificate validation is successful.

See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563127#15 and
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/305264 for similar
problems with gnutls.

[H.-Dirk Schmitt (dirk-computer42)]

In my organisation the CA is based on a V1 CA certificate.
This triggers the following error:
 pluto rsyslogd: not permitted to talk to peer, certificate invalid: signer is not a CA

I can reproduce the problem with gnutls-cli:
   gnutls-cli -V --x509cafile /etc/ssl/certs/proarc-srv.crt -p 42514
pluto.computer42.org
   --> - Peer's certificate issuer is not a CA

If I add '--priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT' to the command above, the certificate validation is successful.

See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563127#15 and
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/305264 for similar problems with gnutls.

[H.-Dirk Schmitt (dirk-computer42)]

Environment is ubuntu karmic / amd64.
rsyslog-gnutls 4.2.0-2ubuntu5.1

[H.-Dirk Schmitt (dirk-computer42)]

rsyslog 4.2.0-2ubuntu5.1
rsyslog-gnutls 4.2.0-2ubuntu5.1
libgnutls26 2.8.3-2

[Rgerhards-j (rgerhards-j)]

closing this bug as the same issue never surfaced from someone else and this is too much work for a single instant.