Add new x509 certificate chain validator in x509_verify.c

The new validator finds multiple validated chains to handle the modern
PKI cases which may frequently have multiple paths via different
intermediates to different roots. It is loosely based on golang's x509
validator

This includes integration so that the new validator can be used via
X509_verify_cert() as well as a new api x509_verify() which will
return multiple chains (similar to go).

The new validator is not enabled by default with this commit, this
will be changed in a follow on commit.

The new public API is not yet exposed, and will be finalized and
exposed with a man page and a library minor bump later.

ok tb@ inoguchi@ jsing@

11 files changed, 1281 insertions, 68 deletions

diff --git a/src/lib/libcrypto/Makefile b/src/lib/libcrypto/Makefile
index 8f11313d58..1a3a388835 100644
--- a/src/lib/libcrypto/Makefile
+++ b/src/lib/libcrypto/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.44 2020/09/11 18:34:29 beck Exp $
+# $OpenBSD: Makefile,v 1.45 2020/09/13 15:06:16 beck Exp $
 
 LIB=    crypto
 LIBREBUILD=y
@@ -277,7 +277,7 @@ SRCS+= x509_bcons.c x509_bitst.c x509_conf.c x509_extku.c x509_ia5.c x509_lib.c
 SRCS+= x509_prn.c x509_utl.c x509_genn.c x509_alt.c x509_skey.c x509_akey.c x509_pku.c
 SRCS+= x509_int.c x509_enum.c x509_sxnet.c x509_cpols.c x509_crld.c x509_purp.c x509_info.c
 SRCS+= x509_ocsp.c x509_akeya.c x509_pmaps.c x509_pcons.c x509_ncons.c x509_pcia.c x509_pci.c
-SRCS+= x509_issuer_cache.c x509_constraints.c
+SRCS+= x509_issuer_cache.c x509_constraints.c x509_verify.c
 SRCS+= pcy_cache.c pcy_node.c pcy_data.c pcy_map.c pcy_tree.c pcy_lib.c
 
 .PATH:  ${.CURDIR}/arch/${MACHINE_CPU} \
@@ -401,6 +401,7 @@ HDRS=\
         ${LCRYPTO_SRC}/whrlpool/whrlpool.h \
         ${LCRYPTO_SRC}/x509/x509.h \
         ${LCRYPTO_SRC}/x509/x509_vfy.h \
+        ${LCRYPTO_SRC}/x509/x509_verify.h \
         ${LCRYPTO_SRC}/x509/x509v3.h
 
 HDRS_GEN=\
diff --git a/src/lib/libcrypto/x509/x509_internal.h b/src/lib/libcrypto/x509/x509_internal.h
index fad6c93231..ced6b306e5 100644
--- a/src/lib/libcrypto/x509/x509_internal.h
+++ b/src/lib/libcrypto/x509/x509_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_internal.h,v 1.1 2020/09/11 18:34:29 beck Exp $ */
+/* $OpenBSD: x509_internal.h,v 1.2 2020/09/13 15:06:17 beck Exp $ */
 /*
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
@@ -20,6 +20,13 @@
 /* Internal use only, not public API */
 #include <netinet/in.h>
 
+#include <openssl/x509_verify.h>
+
+/* Hard limits on structure size and number of signature checks. */
+#define X509_VERIFY_MAX_CHAINS          8       /* Max validated chains */
+#define X509_VERIFY_MAX_CHAIN_CERTS     32      /* Max depth of a chain */
+#define X509_VERIFY_MAX_SIGCHECKS       256     /* Max signature checks */
+
 /*
  * Limit the number of names and constraints we will check in a chain
  * to avoid a hostile input DOS
@@ -53,8 +60,36 @@ struct x509_verify_chain {
         struct x509_constraints_names *names;   /* All names from all certs */
 };
 
+struct x509_verify_ctx {
+        X509_STORE_CTX *xsc;
+        struct x509_verify_chain **chains;      /* Validated chains */
+        size_t chains_count;
+        STACK_OF(X509) *roots;          /* Trusted roots for this validation */
+        STACK_OF(X509) *intermediates;  /* Intermediates provided by peer */
+        time_t *check_time;             /* Time for validity checks */
+        int purpose;                    /* Cert purpose we are validating */
+        size_t max_chains;              /* Max chains to return */
+        size_t max_depth;               /* Max chain depth for validation */
+        size_t max_sigs;                /* Max number of signature checks */
+        size_t sig_checks;              /* Number of signature checks done */
+        size_t error_depth;             /* Depth of last error seen */
+        int error;                      /* Last error seen */
+};
+
+int ASN1_time_tm_clamp_notafter(struct tm *tm);
+
 __BEGIN_HIDDEN_DECLS
 
+int x509_vfy_check_id(X509_STORE_CTX *ctx);
+int x509_vfy_check_revocation(X509_STORE_CTX *ctx);
+int x509_vfy_check_policy(X509_STORE_CTX *ctx);
+int x509_vfy_check_trust(X509_STORE_CTX *ctx);
+int x509_vfy_check_chain_extensions(X509_STORE_CTX *ctx);
+void x509v3_cache_extensions(X509 *x);
+
+struct x509_verify_ctx *x509_verify_ctx_new_from_xsc(X509_STORE_CTX *xsc,
+    STACK_OF(X509) *roots);
+
 void x509_constraints_name_clear(struct x509_constraints_name *name);
 int x509_constraints_names_add(struct x509_constraints_names *names,
     struct x509_constraints_name *name);
diff --git a/src/lib/libcrypto/x509/x509_purp.c b/src/lib/libcrypto/x509/x509_purp.c
index 62b3bcfe3a..f2d46658f6 100644
--- a/src/lib/libcrypto/x509/x509_purp.c
+++ b/src/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.1 2020/06/04 15:19:32 jsing Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.2 2020/09/13 15:06:17 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -73,7 +73,7 @@
 #define ns_reject(x, usage) \
         (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
 
-static void x509v3_cache_extensions(X509 *x);
+void x509v3_cache_extensions(X509 *x);
 
 static int check_ssl_ca(const X509 *x);
 static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x,
@@ -426,7 +426,7 @@ setup_crldp(X509 *x)
                 setup_dp(x, sk_DIST_POINT_value(x->crldp, i));
 }
 
-static void
+void
 x509v3_cache_extensions(X509 *x)
 {
         BASIC_CONSTRAINTS *bs;
diff --git a/src/lib/libcrypto/x509/x509_utl.c b/src/lib/libcrypto/x509/x509_utl.c
index 4641152f74..0fa6ea6d54 100644
--- a/src/lib/libcrypto/x509/x509_utl.c
+++ b/src/lib/libcrypto/x509/x509_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_utl.c,v 1.1 2020/06/04 15:19:32 jsing Exp $ */
+/* $OpenBSD: x509_utl.c,v 1.2 2020/09/13 15:06:17 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -988,7 +988,8 @@ do_x509_check(X509 *x, const char *chk, size_t chklen, unsigned int flags,
                 alt_type = V_ASN1_IA5STRING;
                 equal = equal_email;
         } else if (check_type == GEN_DNS) {
-                cnid = NID_commonName;
+                if (!(flags & X509_CHECK_FLAG_NEVER_CHECK_SUBJECT))
+                        cnid = NID_commonName;
                 /* Implicit client-side DNS sub-domain pattern */
                 if (chklen > 1 && chk[0] == '.')
                         flags |= _X509_CHECK_FLAG_DOT_SUBDOMAINS;
diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c
new file mode 100644
index 0000000000..5f5070c122
--- /dev/null
+++ b/src/lib/libcrypto/x509/x509_verify.c
@@ -0,0 +1,914 @@
+/* $OpenBSD: x509_verify.c,v 1.1 2020/09/13 15:06:17 beck Exp $ */
+/*
+ * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* x509_verify - inspired by golang's crypto/x509/Verify */
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <openssl/safestack.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+
+#include "x509_internal.h"
+#include "x509_issuer_cache.h"
+
+static int x509_verify_cert_valid(struct x509_verify_ctx *ctx, X509 *cert,
+    struct x509_verify_chain *current_chain);
+static void x509_verify_build_chains(struct x509_verify_ctx *ctx, X509 *cert,
+    struct x509_verify_chain *current_chain);
+static int x509_verify_cert_error(struct x509_verify_ctx *ctx, X509 *cert,
+    size_t depth, int error, int ok);
+static void x509_verify_chain_free(struct x509_verify_chain *chain);
+
+#define X509_VERIFY_CERT_HASH (EVP_sha512())
+
+struct x509_verify_chain *
+x509_verify_chain_new(void)
+{
+        struct x509_verify_chain *chain;
+
+        if ((chain = calloc(1, sizeof(*chain))) == NULL)
+                goto err;
+        if ((chain->certs = sk_X509_new_null()) == NULL)
+                goto err;
+        if ((chain->names = x509_constraints_names_new()) == NULL)
+                goto err;
+
+        return chain;
+ err:
+        x509_verify_chain_free(chain);
+        return NULL;
+}
+
+static void
+x509_verify_chain_clear(struct x509_verify_chain *chain)
+{
+        sk_X509_pop_free(chain->certs, X509_free);
+        chain->certs = NULL;
+        x509_constraints_names_free(chain->names);
+        chain->names = NULL;
+}
+
+static void
+x509_verify_chain_free(struct x509_verify_chain *chain)
+{
+        if (chain == NULL)
+                return;
+        x509_verify_chain_clear(chain);
+        free(chain);
+}
+
+static struct x509_verify_chain *
+x509_verify_chain_dup(struct x509_verify_chain *chain)
+{
+        struct x509_verify_chain *new_chain;
+
+        if ((new_chain = x509_verify_chain_new()) == NULL)
+                goto err;
+        if ((new_chain->certs = X509_chain_up_ref(chain->certs)) == NULL)
+                goto err;
+        if ((new_chain->names =
+            x509_constraints_names_dup(chain->names)) == NULL)
+                goto err;
+        return(new_chain);
+ err:
+        x509_verify_chain_free(new_chain);
+        return NULL;
+}
+
+static int
+x509_verify_chain_append(struct x509_verify_chain *chain, X509 *cert,
+    int *error)
+{
+        int verify_err = X509_V_ERR_UNSPECIFIED;
+
+        if (!x509_constraints_extract_names(chain->names, cert,
+            sk_X509_num(chain->certs) == 0, &verify_err)) {
+                *error = verify_err;
+                return 0;
+        }
+        X509_up_ref(cert);
+        if (!sk_X509_push(chain->certs, cert)) {
+                X509_free(cert);
+                *error = X509_V_ERR_UNSPECIFIED;
+                return 0;
+        }
+        return 1;
+}
+
+static X509 *
+x509_verify_chain_last(struct x509_verify_chain *chain)
+{
+        int last;
+
+        if (chain->certs == NULL)
+                return NULL;
+        if ((last = sk_X509_num(chain->certs) - 1) < 0)
+                return NULL;
+        return sk_X509_value(chain->certs, last);
+}
+
+X509 *
+x509_verify_chain_leaf(struct x509_verify_chain *chain)
+{
+        if (chain->certs == NULL)
+                return NULL;
+        return sk_X509_value(chain->certs, 0);
+}
+
+static void
+x509_verify_ctx_reset(struct x509_verify_ctx *ctx)
+{
+        size_t i;
+
+        for (i = 0; i < ctx->chains_count; i++)
+                x509_verify_chain_free(ctx->chains[i]);
+        ctx->error = 0;
+        ctx->error_depth = 0;
+        ctx->chains_count = 0;
+        ctx->sig_checks = 0;
+        ctx->check_time = NULL;
+}
+
+static void
+x509_verify_ctx_clear(struct x509_verify_ctx *ctx)
+{
+        x509_verify_ctx_reset(ctx);
+        sk_X509_pop_free(ctx->intermediates, X509_free);
+        sk_X509_pop_free(ctx->roots, X509_free);
+        free(ctx->chains);
+        memset(ctx, 0, sizeof(*ctx));
+}
+
+static int
+x509_verify_ctx_cert_is_root(struct x509_verify_ctx *ctx, X509 *cert)
+{
+        int i;
+
+        for (i = 0; i < sk_X509_num(ctx->roots); i++) {
+                if (X509_cmp(sk_X509_value(ctx->roots, i), cert) == 0)
+                        return 1;
+        }
+        return 0;
+}
+
+/* Add a validated chain to our list of valid chains */
+static int
+x509_verify_ctx_add_chain(struct x509_verify_ctx *ctx,
+    struct x509_verify_chain *chain)
+{
+        size_t depth;
+        X509 *last = x509_verify_chain_last(chain);
+
+        depth = sk_X509_num(chain->certs);
+        if (depth > 0)
+                depth--;
+
+        if (ctx->chains_count >= ctx->max_chains)
+                return x509_verify_cert_error(ctx, last, depth,
+                    X509_V_ERR_CERT_CHAIN_TOO_LONG, 0);
+
+        /*
+         * If we have a legacy xsc, choose a validated chain,
+         * and apply the extensions, revocation, and policy checks
+         * just like the legacy code did. We do this here instead
+         * of as building the chains to more easily support the
+         * callback and the bewildering array of VERIFY_PARAM
+         * knobs that are there for the fiddling.
+         */
+        if (ctx->xsc != NULL) {
+                ctx->xsc->last_untrusted = depth ? depth - 1 : 0;
+                sk_X509_pop_free(ctx->xsc->chain, X509_free);
+                ctx->xsc->chain = X509_chain_up_ref(chain->certs);
+                if (ctx->xsc->chain == NULL)
+                        return x509_verify_cert_error(ctx, last, depth,
+                            X509_V_ERR_OUT_OF_MEM, 0);
+
+                /*
+                 * XXX currently this duplicates some work done
+                 * in chain build, but we keep it here until
+                 * we have feature parity
+                 */
+                if (!x509_vfy_check_chain_extensions(ctx->xsc))
+                        return 0;
+
+                if (!x509_constraints_chain(ctx->xsc->chain,
+                    &ctx->xsc->error, &ctx->xsc->error_depth)) {
+                        X509 *cert = sk_X509_value(ctx->xsc->chain, depth);
+                        if (!x509_verify_cert_error(ctx, cert,
+                            ctx->xsc->error_depth, ctx->xsc->error, 0))
+                                return 0;
+                }
+
+                if (!x509_vfy_check_revocation(ctx->xsc))
+                        return 0;
+
+                if (!x509_vfy_check_policy(ctx->xsc))
+                        return 0;
+        }
+        /*
+         * no xsc means we are being called from the non-legacy API,
+         * extensions and purpose are dealt with as the chain is built.
+         *
+         * The non-legacy api returns multiple chains but does not do
+         * any revocation checking (it must be done by the caller on
+         * any chain they wish to use)
+         */
+
+        if ((ctx->chains[ctx->chains_count] = x509_verify_chain_dup(chain)) ==
+            NULL) {
+                return x509_verify_cert_error(ctx, last, depth,
+                    X509_V_ERR_OUT_OF_MEM, 0);
+        }
+        ctx->chains_count++;
+        ctx->error = X509_V_OK;
+        ctx->error_depth = depth;
+        return 1;
+}
+
+static int
+x509_verify_potential_parent(struct x509_verify_ctx *ctx, X509 *parent,
+    X509 *child)
+{
+        if (ctx->xsc != NULL)
+                return (ctx->xsc->check_issued(ctx->xsc, child, parent));
+
+        /* XXX key usage */
+        return X509_check_issued(child, parent) != X509_V_OK;
+}
+
+static int
+x509_verify_parent_signature(X509 *parent, X509 *child,
+    unsigned char *child_md, int *error)
+{
+        unsigned char parent_md[EVP_MAX_MD_SIZE] = { 0 };
+        EVP_PKEY *pkey;
+        int cached;
+        int ret = 0;
+
+        /* Use cached value if we have it */
+        if (child_md != NULL) {
+                if (!X509_digest(parent, X509_VERIFY_CERT_HASH, parent_md,
+                    NULL))
+                        return 0;
+                if ((cached = x509_issuer_cache_find(parent_md, child_md)) >= 0)
+                        return cached;
+        }
+
+        /* Check signature. Did parent sign child? */
+        if ((pkey = X509_get_pubkey(parent)) == NULL) {
+                *error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
+                return 0;
+        }
+        if (X509_verify(child, pkey) <= 0)
+                *error = X509_V_ERR_CERT_SIGNATURE_FAILURE;
+        else
+                ret = 1;
+
+        /* Add result to cache */
+        if (child_md != NULL)
+                x509_issuer_cache_add(parent_md, child_md, ret);
+
+        EVP_PKEY_free(pkey);
+
+        return ret;
+}
+
+static int
+x509_verify_consider_candidate(struct x509_verify_ctx *ctx, X509 *cert,
+    unsigned char *cert_md, int is_root_cert, X509 *candidate,
+    struct x509_verify_chain *current_chain)
+{
+        int depth = sk_X509_num(current_chain->certs);
+        struct x509_verify_chain *new_chain;
+        int i;
+
+        /* Fail if the certificate is already in the chain */
+        for (i = 0; i < sk_X509_num(current_chain->certs); i++) {
+                if (X509_cmp(sk_X509_value(current_chain->certs, i),
+                    candidate) == 0)
+                        return 0;
+        }
+
+        if (ctx->sig_checks++ > X509_VERIFY_MAX_SIGCHECKS) {
+                /* don't allow callback to override safety check */
+                (void) x509_verify_cert_error(ctx, candidate, depth,
+                    X509_V_ERR_CERT_CHAIN_TOO_LONG, 0);
+                return 0;
+        }
+
+
+        if (!x509_verify_parent_signature(candidate, cert, cert_md,
+            &ctx->error)) {
+                    if (!x509_verify_cert_error(ctx, candidate, depth,
+                        ctx->error, 0))
+                            return 0;
+        }
+
+        if (!x509_verify_cert_valid(ctx, candidate, current_chain))
+                return 0;
+
+        /* candidate is good, add it to a copy of the current chain */
+        if ((new_chain = x509_verify_chain_dup(current_chain)) == NULL) {
+                x509_verify_cert_error(ctx, candidate, depth,
+                    X509_V_ERR_OUT_OF_MEM, 0);
+                return 0;
+        }
+        if (!x509_verify_chain_append(new_chain, candidate, &ctx->error)) {
+                x509_verify_cert_error(ctx, candidate, depth,
+                    ctx->error, 0);
+                x509_verify_chain_free(new_chain);
+                return 0;
+        }
+
+        /*
+         * If candidate is a trusted root, we have a validated chain,
+         * so we save it.  Otherwise, recurse until we find a root or
+         * give up.
+         */
+        if (is_root_cert &&
+            x509_verify_cert_error(ctx, candidate, depth, X509_V_OK, 1))
+                (void) x509_verify_ctx_add_chain(ctx, new_chain);
+        else
+                x509_verify_build_chains(ctx, candidate, new_chain);
+
+        x509_verify_chain_free(new_chain);
+        return 1;
+}
+
+static int
+x509_verify_cert_error(struct x509_verify_ctx *ctx, X509 *cert, size_t depth,
+    int error, int ok)
+{
+        ctx->error = error;
+        ctx->error_depth = depth;
+        if (ctx->xsc != NULL) {
+                ctx->xsc->error = error;
+                ctx->xsc->error_depth = depth;
+                ctx->xsc->current_cert = cert;
+                return ctx->xsc->verify_cb(ok, ctx->xsc);
+        }
+        return ok;
+}
+
+static void
+x509_verify_build_chains(struct x509_verify_ctx *ctx, X509 *cert,
+    struct x509_verify_chain *current_chain)
+{
+        unsigned char cert_md[EVP_MAX_MD_SIZE] = { 0 };
+        X509 *candidate;
+        int i, depth, count;
+
+        depth = sk_X509_num(current_chain->certs);
+        if (depth > 0)
+                depth--;
+
+        if (depth >= ctx->max_depth &&
+            !x509_verify_cert_error(ctx, cert, depth,
+                X509_V_ERR_CERT_CHAIN_TOO_LONG, 0))
+                return;
+
+        if (!X509_digest(cert, X509_VERIFY_CERT_HASH, cert_md, NULL) &&
+            !x509_verify_cert_error(ctx, cert, depth,
+                X509_V_ERR_UNSPECIFIED, 0))
+                return;
+
+        count = ctx->chains_count;
+        ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY;
+        ctx->error_depth = depth;
+
+        for (i = 0; i < sk_X509_num(ctx->roots); i++) {
+                candidate = sk_X509_value(ctx->roots, i);
+                if (x509_verify_potential_parent(ctx, candidate, cert)) {
+                        x509_verify_consider_candidate(ctx, cert,
+                            cert_md, 1, candidate, current_chain);
+                }
+        }
+
+        if (ctx->intermediates != NULL) {
+                for (i = 0; i < sk_X509_num(ctx->intermediates); i++) {
+                        candidate = sk_X509_value(ctx->intermediates, i);
+                        if (x509_verify_potential_parent(ctx, candidate, cert)) {
+                                x509_verify_consider_candidate(ctx, cert,
+                                    cert_md, 0, candidate, current_chain);
+                        }
+                }
+        }
+        if (ctx->chains_count > count) {
+                if (ctx->xsc != NULL) {
+                        ctx->xsc->error = X509_V_OK;
+                        ctx->xsc->error_depth = depth;
+                        ctx->xsc->current_cert = cert;
+                        (void) ctx->xsc->verify_cb(1, ctx->xsc);
+                }
+        } else if (ctx->error_depth == depth) {
+                        (void) x509_verify_cert_error(ctx, cert, depth,
+                            ctx->error, 0);
+        }
+}
+
+static int
+x509_verify_cert_hostname(struct x509_verify_ctx *ctx, X509 *cert, char *name)
+{
+        char *candidate;
+        size_t len;
+
+        if (name == NULL) {
+                if (ctx->xsc != NULL)
+                        return x509_vfy_check_id(ctx->xsc);
+                return 1;
+        }
+        if ((candidate = strdup(name)) == NULL) {
+                ctx->error = X509_V_ERR_OUT_OF_MEM;
+                goto err;
+        }
+        if ((len = strlen(candidate)) < 1) {
+                ctx->error = X509_V_ERR_UNSPECIFIED; /* XXX */
+                goto err;
+        }
+
+        /* IP addresses may be written in [ ]. */
+        if (candidate[0] == '[' && candidate[len - 1] == ']') {
+                candidate[len - 1] = '\0';
+                if (X509_check_ip_asc(cert, candidate + 1, 0) <= 0) {
+                        ctx->error = X509_V_ERR_IP_ADDRESS_MISMATCH;
+                        goto err;
+                }
+        } else {
+                int flags = 0;
+
+                if (ctx->xsc == NULL)
+                        flags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
+
+                if (X509_check_host(cert, candidate, len, flags, NULL) <= 0) {
+                        ctx->error = X509_V_ERR_HOSTNAME_MISMATCH;
+                        goto err;
+                }
+        }
+        free(candidate);
+        return 1;
+ err:
+        free(candidate);
+        return x509_verify_cert_error(ctx, cert, 0, ctx->error, 0);
+}
+
+static int
+x509_verify_set_check_time(struct x509_verify_ctx *ctx) {
+        if (ctx->xsc != NULL)  {
+                if (ctx->xsc->param->flags & X509_V_FLAG_USE_CHECK_TIME) {
+                        ctx->check_time = &ctx->xsc->param->check_time;
+                        return 1;
+                }
+                if (ctx->xsc->param->flags & X509_V_FLAG_NO_CHECK_TIME)
+                        return 0;
+        }
+
+        ctx->check_time = NULL;
+        return 1;
+}
+
+static int
+x509_verify_asn1_time_to_tm(const ASN1_TIME *atime, struct tm *tm, int notafter)
+{
+        time_t time;
+        int type;
+
+        memset(tm, 0, sizeof(*tm));
+
+        type = ASN1_time_parse(atime->data, atime->length, tm, atime->type);
+        if (type == -1)
+                return 0;
+
+        /* RFC 5280 section 4.1.2.5 */
+        if (tm->tm_year < 150 && type != V_ASN1_UTCTIME)
+                return 0;
+        if (tm->tm_year >= 150 && type != V_ASN1_GENERALIZEDTIME)
+                return 0;
+
+        if (notafter) {
+                /*
+                 * If we are a completely broken operating system with a
+                 * 32 bit time_t, and we have been told this is a notafter
+                 * date, limit the date to a 32 bit representable value.
+                 */
+                if (!ASN1_time_tm_clamp_notafter(tm))
+                        return 0;
+        }
+
+        /*
+         * Defensively fail if the time string is not representable as
+         * a time_t. A time_t must be sane if you care about times after
+         * Jan 19 2038.
+         */
+        if ((time = timegm(tm)) == -1)
+                return 0;
+
+        return 1;
+}
+
+static int
+x509_verify_cert_time(int is_notafter, const ASN1_TIME *cert_asn1,
+    time_t *cmp_time, int *error)
+{
+        struct tm cert_tm, when_tm;
+        time_t when;
+
+        if (cmp_time == NULL)
+                when = time(NULL);
+        else
+                when = *cmp_time;
+
+        if (!x509_verify_asn1_time_to_tm(cert_asn1, &cert_tm,
+            is_notafter)) {
+                *error = is_notafter ?
+                    X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD :
+                    X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
+                return 0;
+        }
+
+        if (gmtime_r(&when, &when_tm) == NULL) {
+                *error = X509_V_ERR_UNSPECIFIED;
+                return 0;
+        }
+
+        if (is_notafter) {
+                if (ASN1_time_tm_cmp(&cert_tm, &when_tm) == -1) {
+                        *error = X509_V_ERR_CERT_HAS_EXPIRED;
+                        return 0;
+                }
+        } else  {
+                if (ASN1_time_tm_cmp(&cert_tm, &when_tm) == 1) {
+                        *error = X509_V_ERR_CERT_NOT_YET_VALID;
+                        return 0;
+                }
+        }
+
+        return 1;
+}
+
+static int
+x509_verify_validate_constraints(X509 *cert,
+    struct x509_verify_chain *current_chain, int *error)
+{
+        struct x509_constraints_names *excluded = NULL;
+        struct x509_constraints_names *permitted = NULL;
+        int err = X509_V_ERR_UNSPECIFIED;
+
+        if (current_chain == NULL)
+                return 1;
+
+        if (cert->nc != NULL) {
+                if ((permitted = x509_constraints_names_new()) == NULL) {
+                        err = X509_V_ERR_OUT_OF_MEM;
+                        goto err;
+                }
+                if ((excluded = x509_constraints_names_new()) == NULL) {
+                        err = X509_V_ERR_OUT_OF_MEM;
+                        goto err;
+                }
+                if (!x509_constraints_extract_constraints(cert,
+                    permitted, excluded, &err))
+                        goto err;
+                if (!x509_constraints_check(current_chain->names,
+                    permitted, excluded, &err))
+                        goto err;
+                x509_constraints_names_free(excluded);
+                x509_constraints_names_free(permitted);
+        }
+
+        return 1;
+ err:
+        *error = err;
+        x509_constraints_names_free(excluded);
+        x509_constraints_names_free(permitted);
+        return 0;
+}
+
+static int
+x509_verify_cert_extensions(struct x509_verify_ctx *ctx, X509 *cert, int need_ca)
+{
+        if (!(cert->ex_flags & EXFLAG_SET)) {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509);
+                x509v3_cache_extensions(cert);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509);
+        }
+
+        if (ctx->xsc != NULL)
+                return 1;       /* legacy is checked after chain is built */
+
+        if (cert->ex_flags & EXFLAG_CRITICAL) {
+                ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
+                return 0;
+        }
+        /* No we don't care about v1, netscape, and other ancient silliness */
+        if (need_ca && (!(cert->ex_flags & EXFLAG_BCONS) &&
+            (cert->ex_flags & EXFLAG_CA))) {
+                ctx->error = X509_V_ERR_INVALID_CA;
+                return 0;
+        }
+        if (ctx->purpose > 0 && X509_check_purpose(cert, ctx->purpose, need_ca)) {
+                ctx->error = X509_V_ERR_INVALID_PURPOSE;
+                return 0;
+        }
+
+        /* XXX support proxy certs later in new api */
+        if (ctx->xsc == NULL && cert->ex_flags & EXFLAG_PROXY) {
+                ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
+                return 0;
+        }
+
+        return 1;
+}
+
+/* Validate that cert is a possible candidate to append to current_chain */
+static int
+x509_verify_cert_valid(struct x509_verify_ctx *ctx, X509 *cert,
+    struct x509_verify_chain *current_chain)
+{
+        X509 *issuer_candidate;
+        int should_be_ca = current_chain != NULL;
+        size_t depth = 0;
+
+        if (!should_be_ca)
+                depth = sk_X509_num(current_chain->certs);
+
+        if (!x509_verify_cert_extensions(ctx, cert, should_be_ca))
+                return 0;
+
+        if (should_be_ca) {
+                issuer_candidate = x509_verify_chain_last(current_chain);
+                if (issuer_candidate != NULL &&
+                    !X509_check_issued(issuer_candidate, cert))
+                        if (!x509_verify_cert_error(ctx, cert, depth,
+                            X509_V_ERR_SUBJECT_ISSUER_MISMATCH, 0))
+                                return 0;
+        }
+
+        if (x509_verify_set_check_time(ctx)) {
+                if (!x509_verify_cert_time(0, X509_get_notBefore(cert),
+                    ctx->check_time, &ctx->error)) {
+                        if (!x509_verify_cert_error(ctx, cert, depth,
+                            ctx->error, 0))
+                                return 0;
+                }
+
+                if (!x509_verify_cert_time(1, X509_get_notAfter(cert),
+                    ctx->check_time, &ctx->error)) {
+                        if (!x509_verify_cert_error(ctx, cert, depth,
+                            ctx->error, 0))
+                                return 0;
+                }
+        }
+
+        if (!x509_verify_validate_constraints(cert, current_chain,
+            &ctx->error) && !x509_verify_cert_error(ctx, cert, depth,
+            ctx->error, 0))
+                return 0;
+
+        return 1;
+}
+
+struct x509_verify_ctx *
+x509_verify_ctx_new_from_xsc(X509_STORE_CTX *xsc, STACK_OF(X509) *roots)
+{
+        struct x509_verify_ctx *ctx;
+
+        if (xsc == NULL)
+                return NULL;
+
+        if ((ctx = calloc(1, sizeof(struct x509_verify_ctx))) == NULL)
+                return NULL;
+
+        ctx->xsc = xsc;
+
+        if ((ctx->roots = X509_chain_up_ref(roots)) == NULL)
+                goto err;
+
+        if (xsc->untrusted &&
+            (ctx->intermediates = X509_chain_up_ref(xsc->untrusted)) == NULL)
+                goto err;
+
+        ctx->max_depth = xsc->param->depth;
+        if (ctx->max_depth == 0 || ctx->max_depth > X509_VERIFY_MAX_CHAIN_CERTS)
+                ctx->max_depth = X509_VERIFY_MAX_CHAIN_CERTS;
+
+        ctx->max_chains = X509_VERIFY_MAX_CHAINS;
+        ctx->max_sigs = X509_VERIFY_MAX_SIGCHECKS;
+
+        if ((ctx->chains = calloc(X509_VERIFY_MAX_CHAINS, sizeof(*ctx->chains))) ==
+            NULL)
+                goto err;
+
+        return ctx;
+ err:
+        x509_verify_ctx_free(ctx);
+        return NULL;
+}
+
+/* Public API */
+
+struct x509_verify_ctx *
+x509_verify_ctx_new(STACK_OF(X509) *roots)
+{
+        struct x509_verify_ctx *ctx;
+
+        if (roots == NULL)
+                return NULL;
+
+        if ((ctx = calloc(1, sizeof(struct x509_verify_ctx))) == NULL)
+                return NULL;
+
+        if ((ctx->roots = X509_chain_up_ref(roots)) == NULL)
+                goto err;
+
+        ctx->max_depth = X509_VERIFY_MAX_CHAIN_CERTS;
+        ctx->max_chains = X509_VERIFY_MAX_CHAINS;
+        ctx->max_sigs = X509_VERIFY_MAX_SIGCHECKS;
+
+        if ((ctx->chains = calloc(X509_VERIFY_MAX_CHAINS,
+            sizeof(*ctx->chains))) == NULL)
+                goto err;
+
+        return ctx;
+ err:
+        x509_verify_ctx_free(ctx);
+        return NULL;
+}
+
+void
+x509_verify_ctx_free(struct x509_verify_ctx *ctx)
+{
+        if (ctx == NULL)
+                return;
+        sk_X509_pop_free(ctx->roots, X509_free);
+        x509_verify_ctx_clear(ctx);
+        free(ctx);
+}
+
+int
+x509_verify_ctx_set_max_depth(struct x509_verify_ctx *ctx, size_t max)
+{
+        if (max < 1 || max > X509_VERIFY_MAX_CHAIN_CERTS)
+                return 0;
+        ctx->max_depth = max;
+        return 1;
+}
+
+int
+x509_verify_ctx_set_max_chains(struct x509_verify_ctx *ctx, size_t max)
+{
+        if (max < 1 || max > X509_VERIFY_MAX_CHAINS)
+                return 0;
+        ctx->max_chains = max;
+        return 1;
+}
+
+int
+x509_verify_ctx_set_max_signatures(struct x509_verify_ctx *ctx, size_t max)
+{
+        if (max < 1)
+                return 0;
+        if (max > 100000)
+                return 0;
+        ctx->max_sigs = max;
+        return 1;
+}
+
+int
+x509_verify_ctx_set_purpose(struct x509_verify_ctx *ctx, int purpose)
+{
+        if (purpose < X509_PURPOSE_MIN || purpose > X509_PURPOSE_MAX)
+                return 0;
+        ctx->purpose = purpose;
+        return 1;
+}
+
+int
+x509_verify_ctx_set_intermediates(struct x509_verify_ctx *ctx,
+    STACK_OF(X509) *intermediates)
+{
+        if ((ctx->intermediates = X509_chain_up_ref(intermediates)) == NULL)
+                return 0;
+        return 1;
+}
+
+const char *
+x509_verify_ctx_error_string(struct x509_verify_ctx *ctx)
+{
+        return X509_verify_cert_error_string(ctx->error);
+}
+
+size_t
+x509_verify_ctx_error_depth(struct x509_verify_ctx *ctx)
+{
+        return ctx->error_depth;
+}
+
+STACK_OF(X509) *
+x509_verify_ctx_chain(struct x509_verify_ctx *ctx, size_t i)
+{
+        if (i >= ctx->chains_count)
+                return NULL;
+        return ctx->chains[i]->certs;
+}
+
+size_t
+x509_verify(struct x509_verify_ctx *ctx, X509 *leaf, char *name)
+{
+        struct x509_verify_chain *current_chain;
+
+        if (ctx == NULL)
+                return 0;
+        if (ctx->roots == NULL || ctx->max_depth == 0) {
+                ctx->error = X509_V_ERR_INVALID_CALL;
+                return 0;
+        }
+
+        if (ctx->xsc != NULL) {
+                if (leaf != NULL || name != NULL) {
+                        ctx->error = X509_V_ERR_INVALID_CALL;
+                        return 0;
+                }
+                leaf = ctx->xsc->cert;
+        }
+
+        if (!x509_verify_cert_valid(ctx, leaf, NULL))
+                return 0;
+
+        if (!x509_verify_cert_hostname(ctx, leaf, name))
+                return 0;
+
+        if (ctx->xsc != NULL) {
+                /*
+                 * XXX
+                 * The legacy code expects the top level cert to be
+                 * there, even if we didn't find a chain. So put it
+                 * there, we will clobber it later if we find a valid
+                 * chain.
+                 */
+                if ((ctx->xsc->chain = sk_X509_new_null()) == NULL) {
+                        ctx->error = X509_V_ERR_OUT_OF_MEM;
+                        return 0;
+                }
+                if (!X509_up_ref(leaf)) {
+                        ctx->error = X509_V_ERR_OUT_OF_MEM;
+                        return 0;
+                }
+                if (!sk_X509_push(ctx->xsc->chain, leaf)) {
+                        X509_free(leaf);
+                        ctx->error = X509_V_ERR_OUT_OF_MEM;
+                        return 0;
+                }
+        }
+
+        if ((current_chain = x509_verify_chain_new()) == NULL) {
+                ctx->error = X509_V_ERR_OUT_OF_MEM;
+                return 0;
+        }
+        if (!x509_verify_chain_append(current_chain, leaf, &ctx->error)) {
+                x509_verify_chain_free(current_chain);
+                return 0;
+        }
+        if (x509_verify_ctx_cert_is_root(ctx, leaf))
+                x509_verify_ctx_add_chain(ctx, current_chain);
+        else
+                x509_verify_build_chains(ctx, leaf, current_chain);
+
+        x509_verify_chain_free(current_chain);
+
+        /*
+         * Safety net:
+         * We could not find a validated chain, and for some reason do not
+         * have an error set.
+         */
+        if (ctx->chains_count == 0 && ctx->error == 0)
+                ctx->error = X509_V_ERR_UNSPECIFIED;
+
+        /* Clear whatever errors happened if we have any validated chain */
+        if (ctx->chains_count > 0)
+                ctx->error = X509_V_OK;
+
+        if (ctx->xsc != NULL) {
+                ctx->xsc->error = ctx->error;
+                return ctx->xsc->verify_cb(ctx->chains_count, ctx->xsc);
+        }
+        return (ctx->chains_count);
+}
diff --git a/src/lib/libcrypto/x509/x509_verify.h b/src/lib/libcrypto/x509/x509_verify.h
new file mode 100644
index 0000000000..a097404f2e
--- /dev/null
+++ b/src/lib/libcrypto/x509/x509_verify.h
@@ -0,0 +1,42 @@
+/* $OpenBSD: x509_verify.h,v 1.1 2020/09/13 15:06:17 beck Exp $ */
+/*
+ * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef HEADER_X509_VERIFY_H
+#define HEADER_X509_VERIFY_H
+
+#ifdef LIBRESSL_INTERNAL
+struct x509_verify_ctx;
+typedef struct x509_verify_ctx X509_VERIFY_CTX;
+
+X509_VERIFY_CTX *x509_verify_ctx_new(STACK_OF(X509) *roots);
+void x509_verify_ctx_free(struct x509_verify_ctx *ctx);
+
+int x509_verify_ctx_set_max_depth(X509_VERIFY_CTX *ctx, size_t max);
+int x509_verify_ctx_set_max_chains(X509_VERIFY_CTX *ctx, size_t max);
+int x509_verify_ctx_set_max_signatures(X509_VERIFY_CTX *ctx, size_t max);
+int x509_verify_ctx_set_purpose(X509_VERIFY_CTX *ctx, int purpose_id);
+int x509_verify_ctx_set_intermediates(X509_VERIFY_CTX *ctx,
+    STACK_OF(X509) *intermediates);
+
+const char *x509_verify_ctx_error_string(X509_VERIFY_CTX *ctx);
+size_t x509_verify_ctx_error_depth(X509_VERIFY_CTX *ctx);
+
+STACK_OF(X509) *x509_verify_ctx_chain(X509_VERIFY_CTX *ctx, size_t chain);
+
+size_t x509_verify(X509_VERIFY_CTX *ctx, X509 *leaf, char *name);
+#endif
+
+#endif
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 28dbf60c38..b1cc9b5a00 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.74 2020/09/12 14:14:02 beck Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.75 2020/09/13 15:06:17 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -77,6 +77,7 @@
 #include "vpm_int.h"
 #include "x509_internal.h"
 #include "x509_lcl.h"
+#include "x509_internal.h"
 
 /* CRL score values */
 
@@ -124,7 +125,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx);
 static int check_name_constraints(X509_STORE_CTX *ctx);
 static int check_trust(X509_STORE_CTX *ctx);
 static int check_revocation(X509_STORE_CTX *ctx);
-static int check_cert(X509_STORE_CTX *ctx);
+static int check_cert(X509_STORE_CTX *ctx, STACK_OF(X509) *chain, int depth);
 static int check_policy(X509_STORE_CTX *ctx);
 
 static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
@@ -144,6 +145,7 @@ static int X509_cmp_time_internal(const ASN1_TIME *ctm, time_t *cmp_time,
     int clamp_notafter);
 
 static int internal_verify(X509_STORE_CTX *ctx);
+static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
 
 int ASN1_time_tm_clamp_notafter(struct tm *tm);
 
@@ -224,7 +226,21 @@ check_id(X509_STORE_CTX *ctx)
 }
 
 int
-X509_verify_cert(X509_STORE_CTX *ctx)
+x509_vfy_check_id(X509_STORE_CTX *ctx) {
+        return check_id(ctx);
+}
+
+/*
+ * This is the effectively broken legacy OpenSSL chain builder. It
+ * might find an unvalidated chain and leave it sitting in
+ * ctx->chain. It does not correctly handle many cases where multiple
+ * chains could exist.
+ *
+ * Oh no.. I know a dirty word...
+ * Oooooooh..
+ */
+static int
+X509_verify_cert_legacy_build_chain(X509_STORE_CTX *ctx, int *bad)
 {
         X509 *x, *xtmp, *xtmp2, *chain_ss = NULL;
         int bad_chain = 0;
@@ -234,39 +250,6 @@ X509_verify_cert(X509_STORE_CTX *ctx)
         int (*cb) (int xok, X509_STORE_CTX *xctx);
         STACK_OF(X509) *sktmp = NULL;
 
-        if (ctx->cert == NULL) {
-                X509error(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
-                ctx->error = X509_V_ERR_INVALID_CALL;
-                return -1;
-        }
-        if (ctx->chain != NULL) {
-                /*
-                 * This X509_STORE_CTX has already been used to verify
-                 * a cert. We cannot do another one.
-                 */
-                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                ctx->error = X509_V_ERR_INVALID_CALL;
-                return -1;
-        }
-        if (ctx->param->id->poisoned) {
-                /*
-                 * This X509_STORE_CTX had failures setting
-                 * up verify parameters. We can not use it.
-                 */
-                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                ctx->error = X509_V_ERR_INVALID_CALL;
-                return -1;
-        }
-        if (ctx->error != X509_V_ERR_INVALID_CALL) {
-                /*
-                 * This X509_STORE_CTX has not been properly initialized.
-                 */
-                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                ctx->error = X509_V_ERR_INVALID_CALL;
-                return -1;
-        }
-        ctx->error = X509_V_OK; /* Initialize to OK */
-
         cb = ctx->verify_cb;
 
         /*
@@ -534,6 +517,23 @@ X509_verify_cert(X509_STORE_CTX *ctx)
                 if (!ok)
                         goto end;
         }
+ end:
+        sk_X509_free(sktmp);
+        X509_free(chain_ss);
+        *bad = bad_chain;
+        return ok;
+}
+
+static int
+X509_verify_cert_legacy(X509_STORE_CTX *ctx)
+{
+        int ok = 0, bad_chain;
+
+        ctx->error = X509_V_OK; /* Initialize to OK */
+
+        ok = X509_verify_cert_legacy_build_chain(ctx, &bad_chain);
+        if (!ok)
+                goto end;
 
         /* We have the chain complete: now we need to check its purpose */
         ok = check_chain_extensions(ctx);
@@ -548,6 +548,7 @@ X509_verify_cert(X509_STORE_CTX *ctx)
         ok = check_id(ctx);
         if (!ok)
                 goto end;
+
         /*
          * Check revocation status: we do this after copying parameters because
          * they may be needed for CRL signature verification.
@@ -569,15 +570,125 @@ X509_verify_cert(X509_STORE_CTX *ctx)
                 ok = ctx->check_policy(ctx);
 
  end:
-        sk_X509_free(sktmp);
-        X509_free(chain_ss);
-
         /* Safety net, error returns must set ctx->error */
         if (ok <= 0 && ctx->error == X509_V_OK)
                 ctx->error = X509_V_ERR_UNSPECIFIED;
+
         return ok;
 }
 
+int
+X509_verify_cert(X509_STORE_CTX *ctx)
+{
+        STACK_OF(X509) *roots = NULL;
+        struct x509_verify_ctx *vctx = NULL;
+        int chain_count = 0;
+
+        if (ctx->cert == NULL) {
+                X509error(X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
+                ctx->error = X509_V_ERR_INVALID_CALL;
+                return -1;
+        }
+        if (ctx->chain != NULL) {
+                /*
+                 * This X509_STORE_CTX has already been used to verify
+                 * a cert. We cannot do another one.
+                 */
+                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ctx->error = X509_V_ERR_INVALID_CALL;
+                return -1;
+        }
+        if (ctx->param->id->poisoned) {
+                /*
+                 * This X509_STORE_CTX had failures setting
+                 * up verify parameters. We can not use it.
+                 */
+                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ctx->error = X509_V_ERR_INVALID_CALL;
+                return -1;
+        }
+        if (ctx->error != X509_V_ERR_INVALID_CALL) {
+                /*
+                 * This X509_STORE_CTX has not been properly initialized.
+                 */
+                X509error(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ctx->error = X509_V_ERR_INVALID_CALL;
+                return -1;
+        }
+
+        /*
+         * If flags request legacy, use the legacy verifier. If we
+         * requested "no alt chains" from the age of hammer pants, use
+         * the legacy verifier because the multi chain verifier really
+         * does find all the "alt chains".
+         *
+         * XXX deprecate the NO_ALT_CHAINS flag?
+         */
+        if ((ctx->param->flags & X509_V_FLAG_LEGACY_VERIFY) ||
+            (ctx->param->flags & X509_V_FLAG_NO_ALT_CHAINS))
+                return X509_verify_cert_legacy(ctx);
+
+        /* Use the modern multi-chain verifier from x509_verify_cert */
+
+        /* Find our trusted roots */
+        ctx->error = X509_V_ERR_OUT_OF_MEM;
+
+        if (ctx->get_issuer == get_issuer_sk) {
+                /*
+                 * We are using the trusted stack method. so
+                 * the roots are in the aptly named "ctx->other_ctx"
+                 * pointer. (It could have been called "al")
+                 */
+                if ((roots = X509_chain_up_ref(ctx->other_ctx)) == NULL)
+                        return -1;
+        } else {
+                /*
+                 * We have a X509_STORE and need to pull out the roots.
+                 * Don't look Ethel...
+                 */
+                STACK_OF(X509_OBJECT) *objs;
+                size_t i, good = 1;
+
+                if ((roots = sk_X509_new_null()) == NULL)
+                        return -1;
+
+                CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
+                if ((objs = X509_STORE_get0_objects(ctx->ctx)) == NULL)
+                                good = 0;
+                for (i = 0; good && i < sk_X509_OBJECT_num(objs); i++) {
+                        X509_OBJECT *obj;
+                        X509 *root;
+                        obj = sk_X509_OBJECT_value(objs, i);
+                        if (obj->type != X509_LU_X509)
+                                continue;
+                        root = obj->data.x509;
+                        if (X509_up_ref(root) == 0)
+                                good = 0;
+                        if (sk_X509_push(roots, root) == 0) {
+                                X509_free(root);
+                                good = 0;
+                        }
+                }
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
+
+                if (!good) {
+                        sk_X509_pop_free(roots, X509_free);
+                        return -1;
+                }
+        }
+
+        if ((vctx = x509_verify_ctx_new_from_xsc(ctx, roots)) != NULL) {
+                ctx->error = X509_V_OK; /* Initialize to OK */
+                chain_count = x509_verify(vctx, NULL, NULL);
+        }
+
+        sk_X509_pop_free(roots, X509_free);
+        x509_verify_ctx_free(vctx);
+
+        /* if we succeed we have a chain in ctx->chain */
+        return (chain_count > 0 && ctx->chain != NULL);
+}
+
 /* Given a STACK_OF(X509) find the issuer of cert (if any)
  */
 
@@ -637,8 +748,8 @@ get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
  * with the supplied purpose
  */
 
-static int
-check_chain_extensions(X509_STORE_CTX *ctx)
+int
+x509_vfy_check_chain_extensions(X509_STORE_CTX *ctx)
 {
 #ifdef OPENSSL_NO_CHAIN_VERIFY
         return 1;
@@ -781,6 +892,11 @@ end:
 }
 
 static int
+check_chain_extensions(X509_STORE_CTX *ctx) {
+        return x509_vfy_check_chain_extensions(ctx);
+}
+
+static int
 check_name_constraints(X509_STORE_CTX *ctx)
 {
         if (!x509_constraints_chain(ctx->chain, &ctx->error,
@@ -875,6 +991,11 @@ static int check_trust(X509_STORE_CTX *ctx)
         return X509_TRUST_UNTRUSTED;
 }
 
+int x509_vfy_check_trust(X509_STORE_CTX *ctx)
+{
+        return check_trust(ctx);
+}
+
 static int
 check_revocation(X509_STORE_CTX *ctx)
 {
@@ -891,24 +1012,29 @@ check_revocation(X509_STORE_CTX *ctx)
                 last = 0;
         }
         for (i = 0; i <= last; i++) {
-                ctx->error_depth = i;
-                ok = check_cert(ctx);
+                ok = check_cert(ctx, ctx->chain, i);
                 if (!ok)
                         return ok;
         }
         return 1;
 }
 
+int
+x509_vfy_check_revocation(X509_STORE_CTX *ctx)
+{
+        return check_revocation(ctx);
+}
+
 static int
-check_cert(X509_STORE_CTX *ctx)
+check_cert(X509_STORE_CTX *ctx, STACK_OF(X509) *chain, int depth)
 {
         X509_CRL *crl = NULL, *dcrl = NULL;
         X509 *x;
         int ok = 0, cnum;
         unsigned int last_reasons;
 
-        cnum = ctx->error_depth;
-        x = sk_X509_value(ctx->chain, cnum);
+        cnum = ctx->error_depth = depth;
+        x = sk_X509_value(chain, cnum);
         ctx->current_cert = x;
         ctx->current_issuer = NULL;
         ctx->current_crl_score = 0;
@@ -1660,8 +1786,8 @@ cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
         return 1;
 }
 
-static int
-check_policy(X509_STORE_CTX *ctx)
+int
+x509_vfy_check_policy(X509_STORE_CTX *ctx)
 {
         int ret;
 
@@ -1707,6 +1833,12 @@ check_policy(X509_STORE_CTX *ctx)
         return 1;
 }
 
+static int
+check_policy(X509_STORE_CTX *ctx)
+{
+        return x509_vfy_check_policy(ctx);
+}
+
 /*
  * Inform the verify callback of an error.
  *
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index c5eae9d398..a68d5c0840 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.h,v 1.30 2018/08/24 19:21:09 tb Exp $ */
+/* $OpenBSD: x509_vfy.h,v 1.31 2020/09/13 15:06:17 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -407,6 +407,9 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
 /* Do not check certificate or CRL validity against current time. */
 #define X509_V_FLAG_NO_CHECK_TIME               0x200000
 
+/* Force the use of the legacy certificate verifcation */
+#define X509_V_FLAG_LEGACY_VERIFY               0x400000
+
 #define X509_VP_FLAG_DEFAULT                    0x1
 #define X509_VP_FLAG_OVERWRITE                  0x2
 #define X509_VP_FLAG_RESET_FLAGS                0x4
diff --git a/src/lib/libcrypto/x509/x509_vpm.c b/src/lib/libcrypto/x509/x509_vpm.c
index baebcf7bca..ca533e26d1 100644
--- a/src/lib/libcrypto/x509/x509_vpm.c
+++ b/src/lib/libcrypto/x509/x509_vpm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vpm.c,v 1.18 2018/04/06 07:08:20 beck Exp $ */
+/* $OpenBSD: x509_vpm.c,v 1.19 2020/09/13 15:06:17 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -178,6 +178,8 @@ x509_verify_param_zero(X509_VERIFY_PARAM *param)
         /*param->inh_flags = X509_VP_FLAG_DEFAULT;*/
         param->inh_flags = 0;
         param->flags = 0;
+        /* XXX remove to enable new verifier by default */
+        param->flags |= X509_V_FLAG_LEGACY_VERIFY;
         param->depth = -1;
         if (param->policies) {
                 sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
diff --git a/src/lib/libcrypto/x509/x509v3.h b/src/lib/libcrypto/x509/x509v3.h
index 8f7f5c5794..d2754fa624 100644
--- a/src/lib/libcrypto/x509/x509v3.h
+++ b/src/lib/libcrypto/x509/x509v3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509v3.h,v 1.1 2020/06/04 15:19:32 jsing Exp $ */
+/* $OpenBSD: x509v3.h,v 1.2 2020/09/13 15:06:17 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -815,6 +815,8 @@ STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x);
 #define X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS 0x8
 /* Constraint verifier subdomain patterns to match a single labels. */
 #define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0x10
+/* Disable checking the CN for a hostname, to support modern validation */
+#define X509_CHECK_FLAG_NEVER_CHECK_SUBJECT 0x20
 
 /*
  * Match reference identifiers starting with "." to any sub-domain.
diff --git a/src/regress/lib/libcrypto/x509/verify.c b/src/regress/lib/libcrypto/x509/verify.c
index 08ca0b24ff..1a11c2ffe5 100644
--- a/src/regress/lib/libcrypto/x509/verify.c
+++ b/src/regress/lib/libcrypto/x509/verify.c
@@ -1,6 +1,7 @@
-/* $OpenBSD: verify.c,v 1.1 2020/07/14 18:33:00 jsing Exp $ */
+/* $OpenBSD: verify.c,v 1.2 2020/09/13 15:06:17 beck Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -23,6 +24,11 @@
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#include <openssl/x509_verify.h>
+
+#define MODE_MODERN_VFY 0
+#define MODE_LEGACY_VFY 1
+#define MODE_VERIFY     2
 
 static int verbose = 1;
 
@@ -94,10 +100,12 @@ verify_cert_cb(int ok, X509_STORE_CTX *xsc)
 }
 
 static void
-verify_cert(const char *roots_file, const char *bundle_file, int *chains)
+verify_cert(const char *roots_file, const char *bundle_file, int *chains,
+    int mode)
 {
         STACK_OF(X509) *roots = NULL, *bundle = NULL;
         X509_STORE_CTX *xsc = NULL;
+        unsigned long flags;
         X509 *leaf = NULL;
         int verify_err;
 
@@ -117,6 +125,16 @@ verify_cert(const char *roots_file, const char *bundle_file, int *chains)
                 ERR_print_errors_fp(stderr);
                 errx(1, "failed to init store context");
         }
+        if (mode == MODE_LEGACY_VFY) {
+                flags = X509_VERIFY_PARAM_get_flags(xsc->param);
+                flags |= X509_V_FLAG_LEGACY_VERIFY;
+                X509_VERIFY_PARAM_set_flags(xsc->param, flags);
+        } else {
+                flags = X509_VERIFY_PARAM_get_flags(xsc->param);
+                flags &= ~X509_V_FLAG_LEGACY_VERIFY;
+                X509_VERIFY_PARAM_set_flags(xsc->param, flags);
+        }
+
         if (verbose)
                 X509_STORE_CTX_set_verify_cb(xsc, verify_cert_cb);
         X509_STORE_CTX_set0_trusted_stack(xsc, roots);
@@ -143,6 +161,60 @@ struct verify_cert_test {
         int failing;
 };
 
+static void
+verify_cert_new(const char *roots_file, const char *bundle_file, int *chains)
+{
+        STACK_OF(X509) *roots = NULL, *bundle = NULL;
+        X509_STORE_CTX *xsc = NULL;
+        X509 *leaf = NULL;
+        struct x509_verify_ctx *ctx;
+
+        *chains = 0;
+
+        if (!certs_from_file(roots_file, &roots))
+                errx(1, "failed to load roots from '%s'", roots_file);
+        if (!certs_from_file(bundle_file, &bundle))
+                errx(1, "failed to load bundle from '%s'", bundle_file);
+        if (sk_X509_num(bundle) < 1)
+                errx(1, "not enough certs in bundle");
+        leaf = sk_X509_shift(bundle);
+
+        if ((xsc = X509_STORE_CTX_new()) == NULL)
+                errx(1, "X509_STORE_CTX");
+        if (!X509_STORE_CTX_init(xsc, NULL, leaf, bundle)) {
+                ERR_print_errors_fp(stderr);
+                errx(1, "failed to init store context");
+        }
+        if (verbose)
+                X509_STORE_CTX_set_verify_cb(xsc, verify_cert_cb);
+
+        if ((ctx = x509_verify_ctx_new(roots)) == NULL)
+                errx(1, "failed to create ctx");
+        if (!x509_verify_ctx_set_intermediates(ctx, bundle))
+                errx(1, "failed to set intermediates");
+
+        if ((*chains = x509_verify(ctx, leaf, NULL)) == 0) {
+                fprintf(stderr, "failed to verify at %lu: %s\n",
+                    x509_verify_ctx_error_depth(ctx),
+                    x509_verify_ctx_error_string(ctx));
+        } else {
+                for (int c = 0; verbose && c < *chains; c++) {
+                        fprintf(stderr, "Chain %d\n--------\n", c);
+                        STACK_OF(X509) * chain = x509_verify_ctx_chain(ctx, c);
+                        for (int i = 0; i < sk_X509_num(chain); i++) {
+                                X509 *cert = sk_X509_value(chain, i);
+                                X509_NAME_print_ex_fp(stderr,
+                                    X509_get_subject_name(cert), 0,
+                                    XN_FLAG_ONELINE);
+                                fprintf(stderr, "\n");
+                        }
+                }
+        }
+        sk_X509_pop_free(roots, X509_free);
+        sk_X509_pop_free(bundle, X509_free);
+        X509_free(leaf);
+}
+
 struct verify_cert_test verify_cert_tests[] = {
         {
                 .id = "1a",
@@ -306,7 +378,7 @@ struct verify_cert_test verify_cert_tests[] = {
     (sizeof(verify_cert_tests) / sizeof(*verify_cert_tests))
 
 static int
-verify_cert_test(const char *certs_path)
+verify_cert_test(const char *certs_path, int mode)
 {
         char *roots_file, *bundle_file;
         struct verify_cert_test *vct;
@@ -325,16 +397,20 @@ verify_cert_test(const char *certs_path)
                         errx(1, "asprintf");
 
                 fprintf(stderr, "== Test %zu (%s)\n", i, vct->id);
-                verify_cert(roots_file, bundle_file, &chains);
-                if ((chains == 0 && vct->want_chains == 0) ||
+                if (mode == MODE_VERIFY)
+                        verify_cert_new(roots_file, bundle_file, &chains);
+                else
+                        verify_cert(roots_file, bundle_file, &chains, mode);
+                if ((mode == 2 && chains == vct->want_chains) ||
+                    (chains == 0 && vct->want_chains == 0) ||
                     (chains == 1 && vct->want_chains > 0)) {
                         fprintf(stderr, "INFO: Succeeded with %d chains%s\n",
-                            chains, vct->failing ? " (known failure)" : "");
-                        if (vct->failing)
+                            chains, vct->failing ? " (legacy failure)" : "");
+                        if (mode == MODE_LEGACY_VFY && vct->failing)
                                 failed |= 1;
                 } else {
                         fprintf(stderr, "FAIL: Failed with %d chains%s\n",
-                            chains, vct->failing ? " (known failure)" : "");
+                            chains, vct->failing ? " (legacy failure)" : "");
                         if (!vct->failing)
                                 failed |= 1;
                 }
@@ -357,7 +433,12 @@ main(int argc, char **argv)
                 exit(1);
         }
 
-        failed |= verify_cert_test(argv[1]);
+        fprintf(stderr, "\n\nTesting legacy x509_vfy\n");
+        failed |= verify_cert_test(argv[1], MODE_LEGACY_VFY);
+        fprintf(stderr, "\n\nTesting modern x509_vfy\n");
+        failed |= verify_cert_test(argv[1], MODE_MODERN_VFY);
+        fprintf(stderr, "\n\nTesting x509_verify\n");
+        failed |= verify_cert_test(argv[1], MODE_VERIFY);
 
         return (failed);
 }