<![CDATA[wolfSSL - Embedded SSL Library — Getting "Key Usage value error" calling SSL_CTX_load_verify_locations]]> https://www.wolfssl.com/forums/topic2209-getting-key-usage-value-error-calling-sslctxloadverifylocations.html Wed, 30 Oct 2024 16:45:31 +0000 PunBB <![CDATA[Re: Getting "Key Usage value error" calling SSL_CTX_load_verify_locations]]> https://www.wolfssl.com/forums/post7994.html#p7994 No problem and my pleasure!!
Warm regards, Anthony

]]> Wed, 30 Oct 2024 16:45:31 +0000 https://www.wolfssl.com/forums/post7994.html#p7994 <![CDATA[Re: Getting "Key Usage value error" calling SSL_CTX_load_verify_locations]]> https://www.wolfssl.com/forums/post7993.html#p7993 Yes that was it, thank you!  I'm new to this whole thing so totally didn't know that was needed.

]]> Wed, 30 Oct 2024 16:08:50 +0000 https://www.wolfssl.com/forums/post7993.html#p7993 <![CDATA[Re: Getting "Key Usage value error" calling SSL_CTX_load_verify_locations]]> https://www.wolfssl.com/forums/post7989.html#p7989 HI jlewis,

My name is Anthony and I am a member of the wolfSSL team.

I noticed that the issuer and subject are the same making this a Root CA certificate.  I think you might need a basic constraints extension that states that this is a CA certificate. 

Warm regards, Anthony

]]> Wed, 30 Oct 2024 15:14:35 +0000 https://www.wolfssl.com/forums/post7989.html#p7989 <![CDATA[Getting "Key Usage value error" calling SSL_CTX_load_verify_locations]]> https://www.wolfssl.com/forums/post7984.html#p7984 Hello, I'm using the openSSL compatibility layer so calling SSL_CTX_load_verify_locations should be calling wolfSSL_CTX_load_verify_locations.  The return value != 1 so I call getSslStackError() and get back "Key usage value error".

I have configured wolfSSL like so:
./configure --enable-dtls --enable-opensslextra --enable-context-extra-user-data --enable-certext --enable-certgen --enable-debug

My CA cert looks like this:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:e7:bf:61:9a:f8:7c:eb:e4:a1:af:96:e9:0b:fd:6b:29:ac:73:f1
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = CA, L = Foster City, O = Zoox, OU = Test Signing Authority
        Validity
            Not Before: Oct 25 20:34:05 2024 GMT
            Not After : Nov 24 20:34:05 2024 GMT
        Subject: C = US, ST = CA, L = Foster City, O = Zoox, OU = Test Signing Authority
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:eb:27:4a:84:16:4d:df:6e:7e:41:6c:fa:20:8c:
                    3d:d2:3a:92:af:dc:e4:f0:0a:3b:cd:de:8d:a1:fe:
                    31:dc:d6:fc:f5:de:d3:75:c2:75:5d:6f:59:14:88:
                    44:8f:09:e2:9d:74:5c:bc:4b:d8:f6:9d:79:24:71:
                    dc:f0:0c:09:17
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:53:e7:bb:d8:37:11:8b:1c:bf:1b:42:10:d1:dc:
         8a:05:52:f3:a7:71:0f:32:e2:aa:e7:3b:bb:e9:66:42:0f:93:
         02:20:32:34:db:d0:e3:fa:94:2a:c2:8b:b6:b1:b2:de:23:47:
         fa:4d:8f:ee:45:ad:47:cb:c6:23:6c:31:06:a1:41:de


Any idea what I'm doing wrong?  Thanks!

]]> Tue, 29 Oct 2024 23:48:09 +0000 https://www.wolfssl.com/forums/post7984.html#p7984