crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity
Files
189e01e35e7fc4e77c625f5fbc70db8e07ae94c2
wolfssl/certs
History
Tobias Frauenschläger faec5fd3d3 Check the CRL when a peer certificate names no OCSP responder 
A client with both OCSP and CRL enabled skipped the CRL check for a
certificate carrying no OCSP responder URL. OcspNoUrlPolicy() maps
OCSP_NO_URL onto 0 for the historical soft-fail default, which is
indistinguishable from a responder answering CERT_GOOD, so the CRL fallback
never ran.

Decide whether the CRL check is still needed from the raw OCSP result, before
the no-URL policy collapses it, for both the leaf and the chain.

A chain certificate whose OCSP lookup was handed to a staple is the one case
where that result is not in yet, since the CertificateStatus entry answering
it has not been parsed. Take the CRL check there anyway, while the
DecodedCert is alive, but keep only CRL_CERT_REVOKED from it: an inconclusive
CRL_MISSING would otherwise reject a certificate whose valid staple is still
on its way, which no CRL ever said anything about.

The tests are gated out under WOLFSSL_CRL_ALLOW_MISSING_CDP, where a
certificate naming no distribution point has its CRL check skipped by design
and the in-tree test certificates name none.

test_ocsp_checkall_staple_crl_missing covers both directions with a fully
stapled chain under OCSP and CRL CHECKALL: an empty CRL store no longer
rejects it, and certs/ocsp/root-ca-crl-revoked.pem, which gencrls.sh now
produces beside the other OCSP CRLs, still does.
2026-09-19 16:36:24 +02:00
..
1024
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
3072
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
4096
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
acert
X509 attribute cert (acert) support.
2024-09-13 08:03:55 -05:00
aia
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
crl
Check the CRL when a peer certificate names no OCSP responder
2026-09-19 16:36:24 +02:00
ecc
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ed448
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ed25519
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
external
Address connection issues in ocsp-stapling test
2026-01-20 09:46:35 -08:00
falcon
Remove liboqs for ML-KEM and ML-DSA, update for Falcon
2026-04-30 11:03:06 +02:00
frodokem
FrodoKEM: ASN.1 keys, X.509 certicates
2026-07-17 22:38:55 +10:00
intermediate
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
lms
Support RFC 9802 LMS and XMSS in X.509 certificate and CSR generation
2026-06-10 10:51:33 +02:00
mldsa
openssl compat errors and mldsa oid fix
2026-07-13 11:56:57 -06:00
ocsp
Check the CRL when a peer certificate names no OCSP responder
2026-09-19 16:36:24 +02:00
p521
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
renewcerts
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
rpk
Add support for raw-public-key
2023-08-11 11:29:15 +09:00
rsapss
certs: re-sign orphaned rsapss/mldsa leaves and add chain guard
2026-07-02 10:34:06 +09:00
sia
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
slhdsa
Add SLH-DSA support for the TLS 1.3 and DTLS 1.3 handshake
2026-08-04 22:23:03 +02:00
sm2
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
statickeys
portability enhancement: use "#!/usr/bin/env <interpreter>" on all perl scripts and shell scripts that use bash extensions, and use "#!/bin/sh" on the rest.
2024-08-20 13:48:33 -05:00
test
Fix test failure for WOLFSSL_OLD_OID_SUM
2026-08-10 16:46:36 -07:00
test-pathlen
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-serial0
tests/api.c, certs/test-serial0/include.am: drop em dash and trailing blank line
2026-05-05 13:46:05 -06:00
ca-cert-chain.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-ecc384-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-ecc384-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-ecc384-key.der
Remove execute bit from a few files.
2018-05-31 10:14:47 -07:00
ca-ecc384-key.pem
Remove execute bit from a few files.
2018-05-31 10:14:47 -07:00
ca-ecc-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-ecc-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ca-ecc-key.der
Remove execute bit from a few files.
2018-05-31 10:14:47 -07:00
ca-ecc-key.pem
Remove execute bit from a few files.
2018-05-31 10:14:47 -07:00
ca-key-pkcs8-attribute.der
add parsing over optional PKCS8 attributes
2024-09-04 15:15:53 -06:00
ca-key.der
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
ca-key.pem
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
check_cert_chains.sh
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
check_dates.sh
add a faketime test and update cert buffers
2024-12-20 10:35:58 -07:00
client-absolute-urn.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ca-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ca-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ca.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-cert-ext.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-cert-ext.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-cert-sha1.pem
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
client-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-crl-dist.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-crl-dist.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc384-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc384-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc384-key.der
Added client/server certs and keys for P-384-bit signed by P-384 CA. Fix for broken certs/ecc/genecc.sh script. Added simple P-384 cipher suite test.
2018-10-25 09:21:27 -07:00
client-ecc384-key.pem
Added client/server certs and keys for P-384-bit signed by P-384 CA. Fix for broken certs/ecc/genecc.sh script. Added simple P-384 cipher suite test.
2018-10-25 09:21:27 -07:00
client-ecc-ca-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc-ca-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-ecc-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-key.der
update client-key.der to new 2048 bit one
2011-12-28 16:33:45 -08:00
client-key.pem
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
client-keyEnc.pem
update client encrypt key to 2048 bit version
2015-03-29 10:53:21 -07:00
client-keyPub.der
Add support for :
2015-09-07 09:51:21 +02:00
client-keyPub.pem
Fixes and improvements for crypto callbacks with TLS (mutual auth) (#4437)
2021-10-07 11:12:06 +10:00
client-relative-uri.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
client-uri-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
csr.attr.der
Use CSR with smaller key size 4096 -> 2048
2020-12-18 12:48:25 +01:00
csr.dsa.der
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
csr.dsa.pem
Implement wolfSSL_BIO_*_connect and wolfSSL_BIO_set_conn_port
2020-12-17 14:26:49 +01:00
csr.ext.der
Add CSR test with Extension Request attribute
2020-12-17 14:27:46 +01:00
csr.signed.der
Tests starting to pass
2020-12-17 14:26:49 +01:00
dh2048.der
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
dh2048.pem
add DH param setting by file and buffer, by ctx too
2011-11-01 14:05:14 -07:00
dh3072.der
Benchmark support for 3072-bit RSA and DH when USE_CERT_BUFFERS_3072 is defined.
2018-06-22 09:30:33 -07:00
dh3072.pem
Add test for 3072-bit RSA and DH and fix modexp
2017-10-17 08:36:39 +10:00
dh4096.der
Fix testing using 4096 bits keys and parameters
2020-04-14 12:03:51 +10:00
dh4096.pem
Fix testing using 4096 bits keys and parameters
2020-04-14 12:03:51 +10:00
dh-priv-2048.der
ssl.c: Move functions out to separate files
2024-04-16 10:30:59 +10:00
dh-priv-2048.pem
ssl.c: Move functions out to separate files
2024-04-16 10:30:59 +10:00
dh-pub-2048.der
ssl.c: Move functions out to separate files
2024-04-16 10:30:59 +10:00
dh-pub-2048.pem
ssl.c: Move functions out to separate files
2024-04-16 10:30:59 +10:00
dh-pubkey-2048.der
Add two public key files in certs folder and register them to gencertbuf.pl
2021-03-19 14:52:58 +09:00
dsa2048.der
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
dsa2048.pem
ssl.c: Move functions out to separate files
2024-04-16 10:30:59 +10:00
dsa3072.der
Benchmark support for 3072-bit RSA and DH when USE_CERT_BUFFERS_3072 is defined.
2018-06-22 09:30:33 -07:00
dsa-pubkey-2048.der
Add two public key files in certs folder and register them to gencertbuf.pl
2021-03-19 14:52:58 +09:00
dsaparams.der
Make changes to support port of NTP from OpenSSL to wolfSSL.
2021-08-02 13:33:18 -07:00
dsaparams.pem
expanding compatibility layer
2016-12-28 14:45:29 -07:00
ecc-client-key.der
update certs, extend ntru to 1000 days, add der formatted ecc, new ecc buffer test
2016-08-12 13:00:52 -06:00
ecc-client-key.pem
ecc client certs
2012-05-02 10:30:15 -07:00
ecc-client-keyPub.der
update certs, extend ntru to 1000 days, add der formatted ecc, new ecc buffer test
2016-08-12 13:00:52 -06:00
ecc-client-keyPub.pem
update certs, extend ntru to 1000 days, add der formatted ecc, new ecc buffer test
2016-08-12 13:00:52 -06:00
ecc-key-comp.pem
add compressed key support
2014-08-29 14:25:58 -07:00
ecc-key.der
1.8.8 init
2011-02-05 11:14:47 -08:00
ecc-key.pem
1.8.8 init
2011-02-05 11:14:47 -08:00
ecc-keyPkcs8.der
Add support for more OpenSSL APIs
2018-11-20 07:54:24 +10:00
ecc-keyPkcs8.pem
fix ecc pkcs8 import
2011-12-01 13:10:01 -08:00
ecc-keyPkcs8Enc.der
Add support for more OpenSSL APIs
2018-11-20 07:54:24 +10:00
ecc-keyPkcs8Enc.pem
fix server-keyPkcs8Enc.pem name change error, password, and add ecc pkcs8 encrypted file
2015-02-11 17:24:15 -08:00
ecc-keyPub.der
Add support for :
2015-09-07 09:51:21 +02:00
ecc-keyPub.pem
Fixes and improvements for crypto callbacks with TLS (mutual auth) (#4437)
2021-10-07 11:12:06 +10:00
ecc-params.der
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
ecc-params.pem
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
ecc-privkey.der
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
ecc-privkey.pem
Add test for private key only ecc key
2017-05-15 10:04:42 +10:00
ecc-privkeyPkcs8.der
Fixes for PKCS8 w/wo encryption as DER/ASN.1. Fixes for building with --disable-oldnames. Fix to enable the PKCS8 enc test without openssl comat. Added additional PKCS8 tests.
2019-08-19 16:27:46 -07:00
ecc-privkeyPkcs8.pem
Add test for ECC private key with PKCS 8 encoding (no crypt) and -----BEGIN EC PRIVATE KEY----- header.
2018-10-17 10:01:29 -07:00
ecc-privOnlyCert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
ecc-privOnlyKey.pem
Add test
2017-06-14 09:44:26 +10:00
ecc-rsa-server.p12
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
empty-issuer-cert.pem
Add generation instructions for empty issuer cert and change expiry to 100 years
2025-06-16 11:39:01 -04:00
entity-no-ca-bool-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
entity-no-ca-bool-key.pem
Fix basic constraints extension present and CA Boolean not asserted
2021-07-02 12:16:16 -06:00
fpki-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
fpki-certpol-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
gen_revoked.sh
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
include.am
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
renewcerts.sh
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
rid-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
rsa2048.der
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
rsa3072.der
Benchmark support for 3072-bit RSA and DH when USE_CERT_BUFFERS_3072 is defined.
2018-06-22 09:30:33 -07:00
rsa-pub-2048.pem
Add Qt 5.12 and 5.13 support
2019-12-06 14:27:01 -07:00
server-cert-chain.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-cert-sha1-root.pem
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
server-cert-sha1.pem
Enforce RFC 8446 SHA-1 certificate rule on TLS 1.3 chains
2026-08-17 09:58:02 -05:00
server-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc384-cert.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc384-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc384-key.der
Added client/server certs and keys for P-384-bit signed by P-384 CA. Fix for broken certs/ecc/genecc.sh script. Added simple P-384 cipher suite test.
2018-10-25 09:21:27 -07:00
server-ecc384-key.pem
Added client/server certs and keys for P-384-bit signed by P-384 CA. Fix for broken certs/ecc/genecc.sh script. Added simple P-384 cipher suite test.
2018-10-25 09:21:27 -07:00
server-ecc-comp.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc-comp.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc-rsa.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc-rsa.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc-self.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc-self.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc.der
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-ecc.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-key.der
add key/cert buffers for CA cert, server key/cert
2014-07-01 08:58:47 -06:00
server-key.pem
change all test keys to 2048 bit, all sigs to SHA-1
2011-10-24 11:41:25 -07:00
server-keyEnc.pem
add encrypted test keys to last patch
2011-10-24 12:20:43 -07:00
server-keyPkcs8.der
add wc_GetPkcs8TraditionalOffset()
2017-03-16 15:14:20 -06:00
server-keyPkcs8.pem
add encrypted test keys to last patch
2011-10-24 12:20:43 -07:00
server-keyPkcs8Enc2.pem
add encrypted test keys to last patch
2011-10-24 12:20:43 -07:00
server-keyPkcs8Enc12.pem
switch pkcs12 encrypted key to 3des since arc4 now off by default
2015-03-29 11:10:21 -07:00
server-keyPkcs8Enc.der
Add support for more OpenSSL APIs
2018-11-20 07:54:24 +10:00
server-keyPkcs8Enc.pem
fix server-keyPkcs8Enc.pem name change error, password, and add ecc pkcs8 encrypted file
2015-02-11 17:24:15 -08:00
server-keyPub.der
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
server-keyPub.pem
update example/test certs for end of year release
2023-12-13 16:41:59 -07:00
server-revoked-cert.pem
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
server-revoked-key.pem
Adjusted gencrls and renewcerts to add a revoked server cert
2015-07-21 17:17:41 -06:00
taoCert.txt
spelling: tiny cleanup.
2024-11-07 07:40:02 -06:00
test-ber-exp02-05-2022.p7b
add test-ber-exp02-05-2022.p7b file for test
2019-02-06 11:11:27 -07:00
test-degenerate.p7b
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-multiple-recipients.p7b
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-servercert-rc2.p12
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-servercert.p12
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-stream-dec.p7b
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test-stream-sign.p7b
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
tsa-bad-ku-cert.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-bad-ku-cert.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-cert.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-cert.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-chain-cert.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-chain-cert.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-chain-key.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-chain-key.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-ecc-cert.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-ecc-cert.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-ecc-key.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-ecc-key.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-extra-eku-cert.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-extra-eku-cert.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-key.der
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
tsa-key.pem
Time-Stamp Protocol (RFC 3161)
2026-07-08 09:33:47 +10:00
wolfssl-website-ca.pem
update external test certificate
2019-10-15 10:11:38 -06:00
x942dh2048.der
PEM example: new example for convert between PEM and DER
2023-07-03 17:20:35 +10:00
x942dh2048.pem
Add test for X9.42 parsing
2021-10-04 11:05:58 -05:00