check_cert() insists on all provided certificates to validate against system CA store

Description

The following code:

php -r  "var_dump(openssl_x509_checkpurpose(file_get_contents('v_crt.pem'), X509_PURPOSE_SSL_SERVER, array('v_ca.pem')));"

Resulted in this output:

bool(false)

But I expected this output instead:

bool(true)

where v_cert.pem contains any letsencrypt issued certificate, v_ca.pem contains two intermediate certs (it's default chain from letsencrypt):
a)
Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1
Subject: C = US, O = Let's Encrypt, CN = R3
b)
Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3
Subject: C = US, O = Internet Security Research Group, CN = ISRG Root X1

b) is issued by "DST Root CA X3" which is already expired certificate [1] that (this is important) no longer exists in local (system wide) ca-certificates store (verify that on your ca-certificates store).

openssl_x509_checkpurpose() uses check_cert() which calls X509_verify_cert().

Behaviour of this is all intermediate certs need to validate agains system ca store otherwise check fails. It will fail EVEN if we have one chain path that validates agains our ca system store.

Impact of this is that perfectly valid certificate chains are considered to be not ok for any purpose.

There is a flag that changes this bahaviour to say "ok" when at least single validated chain is found - X509_V_FLAG_PARTIAL_CHAIN. It makes logic sense for what openssl_x509_checkpurpose() is trying to do.

Some other users of this flag:
https://github.com/curl/curl/pull/4655
https://github.com/curl/curl/pull/4655/commits/146ccff7a7c9cdc5bfc9d4f2076a9e57a03c1eb8
https://github.com/noxxi/p5-io-socket-ssl/blob/master/lib/IO/Socket/SSL.pm#L2475

1. https://community.letsencrypt.org/t/production-chain-changes/150739/3

PHP Version

PHP 8.1.4

Operating System

No response

issue の PHP コマンドを再現し、openssl_x509_checkpurpose() を check_cert() を経由して X509_verify_cert() まで追跡します。現在の検証動作を X509_V_FLAG_PARTIAL_CHAIN と比較し、期限切れの証明書なしで有効な代替チェーンが成功することを確認します。その結果を検証する前に、この証明書チェーンのケースのカバレッジを追加または更新します。