[stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?

[Jean-Yves F. Barbier]

On Tue, 25 Oct 2011 15:54:26 -0400
al_9x at yahoo.com wrote:

... 
> verify=3 means checking is done against local certs.  My point is that 
> if the actual server cert is stored locally (i.e. trusted) that should 
> be enough.  When I put just the server cert in cafile validation (and 
> connection) fails, but when I put the whole chain, it succeeds.  Why 
> isn't the server cert sufficient?

Because the SVR cert is used to signed your own cert, this ensure liability
between svr & cli; and if it was only the SVR cert, how could you revoke
client by client?  
You would be obliged to revoke all clients at once - which doesn't look
like a very good strategy if you've got 1000's of clients...

-- 
You will be dead within a year.