Hi. I think GnuTLS needs a proper RFC 5280 chain validation implementation (see section 6), and it occurred to me that somewhere in the X.509 code in GnuPG2 there may be one. I couldn't find one in libksba. Is there one? What do you think about implementing it in libksba? /Simon