Understanding SSL_SetTrustAnchors

I want to control the set of CA certificates available to authenticate 
client certificates. AIUI I can use SSL_SetTrustAnchors() to do this but 
it isn't working as I'd expect.

The code looks like:

CERTCertList * ca_list = CERT_NewCertList();
SSL_SetTrustAnchors(fd, ca_list); (returns SECSuccess)
.... rest of the handshake ...

So I'm setting it to an empty list which, as I understand it, no client 
certs should be accepted. But I find that client certs are still 
successful when client auth is required.

I'm testing using a CA which has two subordinate CA's, one for clients 
and one for servers. All three CA's are trusted in my server database.

Am I doing this wrong or are my expectations wrong?

ro
-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto