OpenSSL - Unhandled critical extension

Question

We are trying to create a node.js application which should interact with a server over HTTPS (>TLS v1.2). We are given some list of key, cert files to establish a connection with the server. Node HTTPS requires CA, cert, key files which are CA file, server certificate, and key files. When provided these we are getting the following error:

Error: unhandled critical extension.

After spending some time on the internet, we found that the CA cert has some custom extensions. Later when we did openssl verify -CAfile ca_file.pem server_cert.pem we could reproduce it:

error 34 at 0 depth lookup:unhandled critical extension
OK

So, this seems something to do with OpenSSL. How do we make OpenSSL understand our custom extensions? Those custom extensions are critical as well, so that we cannot just ignore the error by setting -ignore_critical.

Answer 1

I got a ssl error in openvpn.

VERIFY ERROR: depth=1, error=unhandled critical extension: CN=xxxx
OpenSSL: error:xxx:SSL routines:tls_process_server_certificate:certificate verify failed

I understand it as the CA insists that some values are critical, and the are not present or wrong in the Certificate.

What fixed it for me with OpenVPN was turning the 'subjectKeyIdentifier' that was set to critical=True, to False in the CA.

Answer 2

From the OpenSSL documentation X509_VERIFY_PARAM_set_flags:

[For OpenSSL,] by default, any unhandled critical extensions in certificates [...] results in a fatal error.

In Node.js HTTPS/TLS Server, a workaround can be to set the rejectUnauthorized option to false. If the client certificate is rejected (checked from req.client.authorized during request), we can manually re-check (may be with pkijs, node-forge or other x509 certificate aware packages), ignoring offending extensions.

---

See the details from my Stack Overflow answer.