title: "openssl verify" gives OK for bad certificate chain
body: <p>There is a self-signed root CA certificate, rootcert.pem,  with the following V3 extensions:</p>
  
  <pre><code>X509v3 extensions:
      X509v3 Key Usage: 
         Certificate Sign
      X509v3 Basic Constraints: 
         CA:TRUE
  </code></pre>
  
  <p>The rootcert.pem has CA flag set to true &amp; its key usage permits certificate signing. The rootcert.pem signs a certificate foocert.pem with the following V3 extensions:</p>
  
  <pre><code>X509v3 extensions:
      X509v3 Basic Constraints: 
          CA:FALSE
      X509v3 Key Usage: 
          Digital Signature, Non Repudiation, Key Encipherment
  </code></pre>
  
  <p>The foocert.pem has CA flag set to false &amp; its key usage does not permit certificate signing. But lets say, the foocert.pem signs a rougecert.pem.</p>
  
  <p>Form a certificate chain of foocert &amp; roguecert:</p>
  
  <pre><code>cat foocert.pem roguecert.pem &gt; roguechain.pem
  </code></pre>
  
  <p>Verify using openssl verify. The verification is successful:</p>
  
  <pre><code>$ openssl verify  -CAfile rootcert.pem roguechain.pem 
  roguechain.pem: OK
  </code></pre>
  
  <p>Verify with x509_strict, still its successful:</p>
  
  <pre><code>$ openssl verify -x509_strict -CAfile rootcert.pem badchain.pem 
  badchain.pem: OK
  </code></pre>
  
  <p>Lets say a system trusts just the root CA certificate. A peer gives its certificate chain, where one of the intermediate certificate is not supposed to be a CA (CA set to false &amp; key usage does not permit certificate signing), still the openssl flags the chain is good?</p>
  
  <p>How do I make openssl not trust such chains?</p>