mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
faec5fd3d3
A client with both OCSP and CRL enabled skipped the CRL check for a certificate carrying no OCSP responder URL. OcspNoUrlPolicy() maps OCSP_NO_URL onto 0 for the historical soft-fail default, which is indistinguishable from a responder answering CERT_GOOD, so the CRL fallback never ran. Decide whether the CRL check is still needed from the raw OCSP result, before the no-URL policy collapses it, for both the leaf and the chain. A chain certificate whose OCSP lookup was handed to a staple is the one case where that result is not in yet, since the CertificateStatus entry answering it has not been parsed. Take the CRL check there anyway, while the DecodedCert is alive, but keep only CRL_CERT_REVOKED from it: an inconclusive CRL_MISSING would otherwise reject a certificate whose valid staple is still on its way, which no CRL ever said anything about. The tests are gated out under WOLFSSL_CRL_ALLOW_MISSING_CDP, where a certificate naming no distribution point has its CRL check skipped by design and the in-tree test certificates name none. test_ocsp_checkall_staple_crl_missing covers both directions with a fully stapled chain under OCSP and CRL CHECKALL: an empty CRL store no longer rejects it, and certs/ocsp/root-ca-crl-revoked.pem, which gencrls.sh now produces beside the other OCSP CRLs, still does.
72 lines
3.0 KiB
Plaintext
72 lines
3.0 KiB
Plaintext
# vim:ft=automake
|
|
# All paths should be given relative to the root
|
|
#
|
|
|
|
EXTRA_DIST += \
|
|
certs/ocsp/index-ca-and-intermediate-cas.txt \
|
|
certs/ocsp/index-ca-and-intermediate-cas.txt.attr \
|
|
certs/ocsp/index-intermediate1-ca-issued-certs.txt \
|
|
certs/ocsp/index-intermediate1-ca-issued-certs.txt.attr \
|
|
certs/ocsp/index-intermediate2-ca-issued-certs.txt \
|
|
certs/ocsp/index-intermediate2-ca-issued-certs.txt.attr \
|
|
certs/ocsp/index-intermediate3-ca-issued-certs.txt \
|
|
certs/ocsp/index-intermediate3-ca-issued-certs.txt.attr \
|
|
certs/ocsp/openssl.cnf \
|
|
certs/ocsp/renewcerts-for-test.sh \
|
|
certs/ocsp/intermediate1-ca-key.pem \
|
|
certs/ocsp/intermediate1-ca-key.der \
|
|
certs/ocsp/intermediate1-ca-cert.pem \
|
|
certs/ocsp/intermediate1-ca-cert.der \
|
|
certs/ocsp/intermediate2-ca-key.pem \
|
|
certs/ocsp/intermediate2-ca-key.der \
|
|
certs/ocsp/intermediate2-ca-cert.pem \
|
|
certs/ocsp/intermediate2-ca-cert.der \
|
|
certs/ocsp/intermediate3-ca-key.pem \
|
|
certs/ocsp/intermediate3-ca-key.der \
|
|
certs/ocsp/intermediate3-ca-cert.pem \
|
|
certs/ocsp/intermediate3-ca-cert.der \
|
|
certs/ocsp/ocsp-responder-key.pem \
|
|
certs/ocsp/ocsp-responder-key.der \
|
|
certs/ocsp/ocsp-responder-cert.pem \
|
|
certs/ocsp/ocsp-responder-cert.der \
|
|
certs/ocsp/ocsp-responder-int1-key.pem \
|
|
certs/ocsp/ocsp-responder-int1-key.der \
|
|
certs/ocsp/ocsp-responder-int1-cert.pem \
|
|
certs/ocsp/ocsp-responder-int1-cert.der \
|
|
certs/ocsp/server1-key.pem \
|
|
certs/ocsp/server1-key.der \
|
|
certs/ocsp/server1-cert.pem \
|
|
certs/ocsp/server1-cert.der \
|
|
certs/ocsp/server1-chain-noroot.pem \
|
|
certs/ocsp/server2-key.pem \
|
|
certs/ocsp/server2-key.der \
|
|
certs/ocsp/server2-cert.pem \
|
|
certs/ocsp/server2-cert.der \
|
|
certs/ocsp/server3-key.pem \
|
|
certs/ocsp/server3-key.der \
|
|
certs/ocsp/server3-cert.pem \
|
|
certs/ocsp/server3-cert.der \
|
|
certs/ocsp/server4-key.pem \
|
|
certs/ocsp/server4-key.der \
|
|
certs/ocsp/server4-cert.pem \
|
|
certs/ocsp/server4-cert.der \
|
|
certs/ocsp/server5-key.pem \
|
|
certs/ocsp/server5-key.der \
|
|
certs/ocsp/server5-cert.pem \
|
|
certs/ocsp/server5-cert.der \
|
|
certs/ocsp/root-ca-key.pem \
|
|
certs/ocsp/root-ca-key.der \
|
|
certs/ocsp/root-ca-cert.pem \
|
|
certs/ocsp/root-ca-cert.der \
|
|
certs/ocsp/root-ca-crl.pem \
|
|
certs/ocsp/root-ca-crl-revoked.pem \
|
|
certs/ocsp/imposter-root-ca-key.pem \
|
|
certs/ocsp/imposter-root-ca-key.der \
|
|
certs/ocsp/imposter-root-ca-cert.pem \
|
|
certs/ocsp/imposter-root-ca-cert.der \
|
|
certs/ocsp/test-response.der \
|
|
certs/ocsp/test-response-rsapss.der \
|
|
certs/ocsp/test-response-nointern.der \
|
|
certs/ocsp/test-multi-response.der \
|
|
certs/ocsp/test-leaf-response.der
|