Skip to content

Commit 21eb421

Browse files
padelsbachpadelsbach
committed
Add CRL generation code
1 parent c807903 commit 21eb421

22 files changed

Lines changed: 2272 additions & 73 deletions

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ ecc-key.der
104104
ecc-key.pem
105105
certreq.der
106106
certreq.pem
107+
crlRsaOut.pem
108+
crlRsaOut.der
109+
crlEccOut.pem
110+
crlEccOut.der
107111
pkcs7cert.der
108112
pkcs7authEnvelopedDataAES128GCM.der
109113
pkcs7authEnvelopedDataAES128GCM_ECDH_SHA1KDF.der
@@ -470,3 +474,6 @@ wolfssl/debug-trace-error-codes.h
470474
wolfssl/debug-untrace-error-codes.h
471475

472476
AGENTS.md
477+
478+
# Code navigation files
479+
compile_commands.json

‎certs/client-ca-cert.der‎

1.22 KB
Binary file not shown.

‎certs/client-ca-cert.pem‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number: 4661 (0x1235)
5+
Signature Algorithm: sha256WithRSAEncryption
6+
Issuer: C = US, ST = Montana, L = Bozeman, O = Sawtooth, OU = Consulting, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
7+
Validity
8+
Not Before: Jan 24 20:31:13 2026 GMT
9+
Not After : Oct 20 20:31:13 2028 GMT
10+
Subject: C = US, ST = Montana, L = Bozeman, O = wolfSSL_2048, OU = Programming-2048, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
11+
Subject Public Key Info:
12+
Public Key Algorithm: rsaEncryption
13+
Public-Key: (2048 bit)
14+
Modulus:
15+
00:c3:03:d1:2b:fe:39:a4:32:45:3b:53:c8:84:2b:
16+
2a:7c:74:9a:bd:aa:2a:52:07:47:d6:a6:36:b2:07:
17+
32:8e:d0:ba:69:7b:c6:c3:44:9e:d4:81:48:fd:2d:
18+
68:a2:8b:67:bb:a1:75:c8:36:2c:4a:d2:1b:f7:8b:
19+
ba:cf:0d:f9:ef:ec:f1:81:1e:7b:9b:03:47:9a:bf:
20+
65:cc:7f:65:24:69:a6:e8:14:89:5b:e4:34:f7:c5:
21+
b0:14:93:f5:67:7b:3a:7a:78:e1:01:56:56:91:a6:
22+
13:42:8d:d2:3c:40:9c:4c:ef:d1:86:df:37:51:1b:
23+
0c:a1:3b:f5:f1:a3:4a:35:e4:e1:ce:96:df:1b:7e:
24+
bf:4e:97:d0:10:e8:a8:08:30:81:af:20:0b:43:14:
25+
c5:74:67:b4:32:82:6f:8d:86:c2:88:40:99:36:83:
26+
ba:1e:40:72:22:17:d7:52:65:24:73:b0:ce:ef:19:
27+
cd:ae:ff:78:6c:7b:c0:12:03:d4:4e:72:0d:50:6d:
28+
3b:a3:3b:a3:99:5e:9d:c8:d9:0c:85:b3:d9:8a:d9:
29+
54:26:db:6d:fa:ac:bb:ff:25:4c:c4:d1:79:f4:71:
30+
d3:86:40:18:13:b0:63:b5:72:4e:30:c4:97:84:86:
31+
2d:56:2f:d7:15:f7:7f:c0:ae:f5:fc:5b:e5:fb:a1:
32+
ba:d3
33+
Exponent: 65537 (0x10001)
34+
X509v3 extensions:
35+
X509v3 Basic Constraints: critical
36+
CA:FALSE
37+
X509v3 Key Usage: critical
38+
Digital Signature, Key Encipherment
39+
X509v3 Extended Key Usage:
40+
TLS Web Client Authentication
41+
X509v3 Subject Key Identifier:
42+
33:D8:45:66:D7:68:87:18:7E:54:0D:70:27:91:C7:26:D7:85:65:C0
43+
X509v3 Authority Key Identifier:
44+
keyid:27:8E:67:11:74:C3:26:1D:3F:ED:33:63:B3:A4:D8:1D:30:E5:E8:D5
45+
DirName:/C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
46+
serial:3F:29:11:20:57:71:E7:8E:F9:18:0D:CA:70:4D:5B:15:2A:43:D6:24
47+
Signature Algorithm: sha256WithRSAEncryption
48+
Signature Value:
49+
7f:71:41:b2:72:c1:a9:ba:c9:52:40:ea:6d:3d:3d:c0:ae:1e:
50+
44:cd:f9:a5:d6:ac:34:5f:8b:ed:cd:91:81:0f:05:0f:5e:4b:
51+
b3:18:bf:33:7a:61:a5:25:f1:91:55:c1:12:66:b7:26:3b:9c:
52+
bb:21:1a:0c:72:78:88:57:fa:49:22:e7:80:2f:c1:40:01:66:
53+
3d:20:63:e7:e3:38:a9:54:39:52:42:d2:b6:38:6b:08:7d:45:
54+
49:1a:de:b5:64:70:c9:65:ce:0b:94:24:ee:b4:46:67:3c:74:
55+
f0:2a:61:4d:b2:fc:6e:ca:c0:36:a9:b0:d3:5a:e2:15:72:f5:
56+
a4:90:73:b2:37:58:b4:10:39:d3:85:5f:56:91:7e:cf:54:5d:
57+
c6:a7:40:36:bd:ed:f2:af:e5:ce:b6:ea:38:be:47:32:6f:ed:
58+
d2:ba:9d:70:e1:74:2e:f0:27:e4:72:53:75:43:ce:0a:07:b4:
59+
7e:74:17:00:55:b5:d1:92:e4:42:39:ca:84:51:84:f8:23:a6:
60+
41:27:fb:20:e2:43:e3:74:d3:ce:95:4e:1f:06:de:65:5e:e3:
61+
38:e2:eb:f1:a6:ca:6b:7c:56:51:c0:02:1e:6e:3f:51:c1:d5:
62+
04:c0:3d:57:56:15:65:76:a4:f4:eb:43:27:2c:c3:58:29:5c:
63+
18:da:e8:fd
64+
-----BEGIN CERTIFICATE-----
65+
MIIE3zCCA8egAwIBAgICEjUwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
66+
MRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMREwDwYDVQQKDAhT
67+
YXd0b290aDETMBEGA1UECwwKQ29uc3VsdGluZzEYMBYGA1UEAwwPd3d3LndvbGZz
68+
c2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDEy
69+
NDIwMzExM1oXDTI4MTAyMDIwMzExM1owgZ4xCzAJBgNVBAYTAlVTMRAwDgYDVQQI
70+
DAdNb250YW5hMRAwDgYDVQQHDAdCb3plbWFuMRUwEwYDVQQKDAx3b2xmU1NMXzIw
71+
NDgxGTAXBgNVBAsMEFByb2dyYW1taW5nLTIwNDgxGDAWBgNVBAMMD3d3dy53b2xm
72+
c3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCCASIwDQYJ
73+
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMMD0Sv+OaQyRTtTyIQrKnx0mr2qKlIH
74+
R9amNrIHMo7Quml7xsNEntSBSP0taKKLZ7uhdcg2LErSG/eLus8N+e/s8YEee5sD
75+
R5q/Zcx/ZSRppugUiVvkNPfFsBST9Wd7Onp44QFWVpGmE0KN0jxAnEzv0YbfN1Eb
76+
DKE79fGjSjXk4c6W3xt+v06X0BDoqAgwga8gC0MUxXRntDKCb42GwohAmTaDuh5A
77+
ciIX11JlJHOwzu8Zza7/eGx7wBID1E5yDVBtO6M7o5lencjZDIWz2YrZVCbbbfqs
78+
u/8lTMTRefRx04ZAGBOwY7VyTjDEl4SGLVYv1xX3f8Cu9fxb5fuhutMCAwEAAaOC
79+
AS0wggEpMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG
80+
CCsGAQUFBwMCMB0GA1UdDgQWBBQz2EVm12iHGH5UDXAnkccm14VlwDCB1AYDVR0j
81+
BIHMMIHJgBQnjmcRdMMmHT/tM2OzpNgdMOXo1aGBmqSBlzCBlDELMAkGA1UEBhMC
82+
VVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoM
83+
CFNhd3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29s
84+
ZnNzbC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb22CFD8pESBX
85+
ceeO+RgNynBNWxUqQ9YkMA0GCSqGSIb3DQEBCwUAA4IBAQB/cUGycsGpuslSQOpt
86+
PT3Arh5Ezfml1qw0X4vtzZGBDwUPXkuzGL8zemGlJfGRVcESZrcmO5y7IRoMcniI
87+
V/pJIueAL8FAAWY9IGPn4zipVDlSQtK2OGsIfUVJGt61ZHDJZc4LlCTutEZnPHTw
88+
KmFNsvxuysA2qbDTWuIVcvWkkHOyN1i0EDnThV9WkX7PVF3Gp0A2ve3yr+XOtuo4
89+
vkcyb+3Sup1w4XQu8CfkclN1Q84KB7R+dBcAVbXRkuRCOcqEUYT4I6ZBJ/sg4kPj
90+
dNPOlU4fBt5lXuM44uvxpsprfFZRwAIebj9RwdUEwD1XVhVldqT060MnLMNYKVwY
91+
2uj9
92+
-----END CERTIFICATE-----

‎certs/client-ecc-ca-cert.der‎

655 Bytes
Binary file not shown.

‎certs/client-ecc-ca-cert.pem‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number: 4660 (0x1234)
5+
Signature Algorithm: ecdsa-with-SHA256
6+
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Development, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
7+
Validity
8+
Not Before: Jan 24 20:12:22 2026 GMT
9+
Not After : Oct 20 20:12:22 2028 GMT
10+
Subject: C = US, ST = Oregon, L = Salem, O = Client ECC, OU = Fast, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
11+
Subject Public Key Info:
12+
Public Key Algorithm: id-ecPublicKey
13+
Public-Key: (256 bit)
14+
pub:
15+
04:55:bf:f4:0f:44:50:9a:3d:ce:9b:b7:f0:c5:4d:
16+
f5:70:7b:d4:ec:24:8e:19:80:ec:5a:4c:a2:24:03:
17+
62:2c:9b:da:ef:a2:35:12:43:84:76:16:c6:56:95:
18+
06:cc:01:a9:bd:f6:75:1a:42:f7:bd:a9:b2:36:22:
19+
5f:c7:5d:7f:b4
20+
ASN1 OID: prime256v1
21+
NIST CURVE: P-256
22+
X509v3 extensions:
23+
X509v3 Subject Key Identifier:
24+
EB:D4:4B:59:6B:95:61:3F:51:57:B6:04:4D:89:41:88:44:5C:AB:F2
25+
X509v3 Authority Key Identifier:
26+
56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21
27+
X509v3 Basic Constraints: critical
28+
CA:FALSE
29+
X509v3 Key Usage: critical
30+
Digital Signature, Key Encipherment, Key Agreement
31+
X509v3 Extended Key Usage:
32+
TLS Web Client Authentication
33+
Signature Algorithm: ecdsa-with-SHA256
34+
Signature Value:
35+
30:45:02:21:00:9d:4d:72:4a:fb:f7:19:96:e3:d3:c2:75:ed:
36+
b5:39:18:44:e7:61:7d:5e:31:d0:3c:eb:45:b3:6f:38:68:f9:
37+
1d:02:20:57:c1:19:e8:c8:8a:14:e7:37:d1:93:b3:46:f5:eb:
38+
8f:24:31:6c:78:d7:cd:b7:c9:8e:09:54:6e:4d:3b:7b:7b
39+
-----BEGIN CERTIFICATE-----
40+
MIICizCCAjGgAwIBAgICEjQwCgYIKoZIzj0EAwIwgZcxCzAJBgNVBAYTAlVTMRMw
41+
EQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3
42+
b2xmU1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZz
43+
c2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2MDEy
44+
NDIwMTIyMloXDTI4MTAyMDIwMTIyMlowgY0xCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
45+
DAZPcmVnb24xDjAMBgNVBAcMBVNhbGVtMRMwEQYDVQQKDApDbGllbnQgRUNDMQ0w
46+
CwYDVQQLDARGYXN0MRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG
47+
9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
48+
AARVv/QPRFCaPc6bt/DFTfVwe9TsJI4ZgOxaTKIkA2Ism9rvojUSQ4R2FsZWlQbM
49+
Aam99nUaQve9qbI2Il/HXX+0o3UwczAdBgNVHQ4EFgQU69RLWWuVYT9RV7YETYlB
50+
iERcq/IwHwYDVR0jBBgwFoAUVo6aw/BC3hi5RVVu+ZPP6sPzpSEwDAYDVR0TAQH/
51+
BAIwADAOBgNVHQ8BAf8EBAMCA6gwEwYDVR0lBAwwCgYIKwYBBQUHAwIwCgYIKoZI
52+
zj0EAwIDSAAwRQIhAJ1Nckr79xmW49PCde21ORhE52F9XjHQPOtFs284aPkdAiBX
53+
wRnoyIoU5zfRk7NG9euPJDFseNfNt8mOCVRuTTt7ew==
54+
-----END CERTIFICATE-----

‎certs/include.am‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ EXTRA_DIST += \
3232
certs/ecc-client-keyPub.pem \
3333
certs/empty-issuer-cert.pem \
3434
certs/client-ecc-cert.pem \
35+
certs/client-ecc-ca-cert.pem \
3536
certs/client-ca.pem \
37+
certs/client-ca-cert.pem \
3638
certs/dh2048.pem \
3739
certs/server-cert.pem \
3840
certs/server-ecc.pem \
@@ -91,6 +93,8 @@ EXTRA_DIST += \
9193
certs/client-cert.der \
9294
certs/client-key.der \
9395
certs/client-ecc-cert.der \
96+
certs/client-ecc-ca-cert.der \
97+
certs/client-ca-cert.der \
9498
certs/client-keyPub.der \
9599
certs/client-keyPub.pem \
96100
certs/dh2048.der \
@@ -154,4 +158,3 @@ include certs/sphincs/include.am
154158
include certs/rpk/include.am
155159
include certs/acert/include.am
156160
include certs/mldsa/include.am
157-

‎certs/renewcerts.sh‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121
# 1024/client-cert.pem
2222
# server-ecc-comp.pem
2323
# client-ca.pem
24+
# client-ca-cert.der
25+
# client-ca-cert.pem
26+
# client-ecc-ca-cert.der
27+
# client-ecc-ca-cert.pem
2428
# test/digsigku.pem
2529
# ecc-privOnlyCert.pem
2630
# client-uri-cert.pem
@@ -896,6 +900,61 @@ run_renewcerts(){
896900
echo "End of section"
897901
echo "---------------------------------------------------------------------"
898902

903+
############################################################
904+
########## update and sign client-ca-cert.pem ##############
905+
############################################################
906+
echo "Updating client-ca-cert.pem"
907+
echo ""
908+
cat > client-ca-ext.cnf <<'EOF'
909+
[ client_ca ]
910+
subjectKeyIdentifier=hash
911+
authorityKeyIdentifier=keyid:always,issuer:always
912+
basicConstraints=critical, CA:FALSE
913+
keyUsage=critical, digitalSignature, keyEncipherment
914+
extendedKeyUsage=clientAuth
915+
EOF
916+
check_result $? "Step 1"
917+
918+
#pipe the following arguments to openssl req...
919+
echo -e "US\\nMontana\\nBozeman\\nwolfSSL_2048\\nProgramming-2048\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key client-key.pem -config ./wolfssl.cnf -nodes > client-ca-cert-req.pem
920+
check_result $? "Step 2"
921+
922+
openssl x509 -req -in client-ca-cert-req.pem -extfile client-ca-ext.cnf -extensions client_ca -days 1000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 0x1235 > client-ca-cert.pem
923+
check_result $? "Step 3"
924+
rm client-ca-cert-req.pem
925+
926+
openssl x509 -in client-ca-cert.pem -text > tmp.pem
927+
check_result $? "Step 4"
928+
mv tmp.pem client-ca-cert.pem
929+
930+
openssl x509 -inform PEM -in client-ca-cert.pem -outform DER -out client-ca-cert.der
931+
check_result $? "Step 5"
932+
rm client-ca-ext.cnf
933+
echo "End of section"
934+
echo "---------------------------------------------------------------------"
935+
936+
############################################################
937+
####### update and sign client-ecc-ca-cert.pem #############
938+
############################################################
939+
echo "Updating client-ecc-ca-cert.pem"
940+
echo ""
941+
#pipe the following arguments to openssl req...
942+
echo -e "US\\nOregon\\nSalem\\nClient ECC\\nFast\\nwww.wolfssl.com\\ninfo@wolfssl.com\\n.\\n.\\n" | openssl req -new -key ecc-client-key.pem -config ./wolfssl.cnf -nodes > client-ecc-ca-cert-req.pem
943+
check_result $? "Step 1"
944+
945+
openssl x509 -req -in client-ecc-ca-cert-req.pem -extfile wolfssl.cnf -extensions client_ecc -days 1000 -CA ca-ecc-cert.pem -CAkey ca-ecc-key.pem -set_serial 0x1234 > client-ecc-ca-cert.pem
946+
check_result $? "Step 2"
947+
rm client-ecc-ca-cert-req.pem
948+
949+
openssl x509 -in client-ecc-ca-cert.pem -text > tmp.pem
950+
check_result $? "Step 3"
951+
mv tmp.pem client-ecc-ca-cert.pem
952+
953+
openssl x509 -inform PEM -in client-ecc-ca-cert.pem -outform DER -out client-ecc-ca-cert.der
954+
check_result $? "Step 4"
955+
echo "End of section"
956+
echo "---------------------------------------------------------------------"
957+
899958
#cleanup the file system now that we're done
900959
echo "Performing final steps, cleaning up the file system..."
901960
echo ""

‎scripts/crl-gen-openssl.test‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
# Verifies CRLs generated by the C API unit tests (tests/api.c).
6+
# Uses OpenSSL to validate CRL structure, signature, and revocation behavior.
7+
# RSA: ca-cert.pem + server-cert.pem (revoked) + client-ca-cert.pem (good).
8+
# ECC: ca-ecc-cert.pem + server-ecc.pem (revoked) + client-ecc-ca-cert.pem (good).
9+
10+
OPENSSL=${OPENSSL:-openssl}
11+
12+
if ! command -v "$OPENSSL" >/dev/null 2>&1; then
13+
echo "skipping crl-gen-openssl.test: openssl not found"
14+
exit 77
15+
fi
16+
17+
normalize_dn() {
18+
sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' \
19+
-e 's/^issuer=//' -e 's/^subject=//' \
20+
-e 's/[[:space:]]*=[[:space:]]*/=/g' \
21+
-e 's/[[:space:]]*,[[:space:]]*/,/g'
22+
}
23+
24+
check_crl() {
25+
local crl="$1"
26+
local ca_cert="$2"
27+
local revoked_cert="$3"
28+
local good_cert="$4"
29+
local label="$5"
30+
31+
echo "Checking $label CRL: $crl"
32+
33+
local issuer subject
34+
issuer=$("$OPENSSL" crl -in "$crl" -noout -issuer | normalize_dn)
35+
subject=$("$OPENSSL" x509 -in "$ca_cert" -noout -subject | normalize_dn)
36+
if [ "$issuer" != "$subject" ]; then
37+
echo "issuer mismatch for $label CRL"
38+
echo "issuer : $issuer"
39+
echo "subject: $subject"
40+
return 1
41+
fi
42+
43+
local last_update next_update
44+
last_update=$("$OPENSSL" crl -in "$crl" -noout -lastupdate)
45+
next_update=$("$OPENSSL" crl -in "$crl" -noout -nextupdate)
46+
if [ -z "$last_update" ] || [ -z "$next_update" ]; then
47+
echo "missing lastUpdate/nextUpdate for $label CRL"
48+
return 1
49+
fi
50+
51+
if ! "$OPENSSL" crl -in "$crl" -noout -verify -CAfile "$ca_cert" >/dev/null 2>&1; then
52+
echo "CRL signature verification failed for $label"
53+
return 1
54+
fi
55+
56+
local revoked_count
57+
revoked_count=$("$OPENSSL" crl -in "$crl" -text -noout | grep -c "Serial Number" || true)
58+
if [ "$revoked_count" -ne 4 ]; then
59+
echo "unexpected revoked count for $label CRL: $revoked_count (expected 4)"
60+
return 1
61+
fi
62+
63+
local serial found
64+
serial=$("$OPENSSL" x509 -in "$revoked_cert" -noout -serial | cut -d= -f2 \
65+
| tr 'A-F' 'a-f' | tr -d ':' | sed 's/^0*//')
66+
if [ -z "$serial" ]; then
67+
serial=0
68+
fi
69+
70+
found=0
71+
while IFS= read -r s; do
72+
s=$(printf '%s' "$s" | tr 'A-F' 'a-f' | tr -d '[:space:]:' \
73+
| sed 's/^0*//')
74+
if [ -z "$s" ]; then
75+
s=0
76+
fi
77+
if [ "$s" = "$serial" ]; then
78+
found=1
79+
break
80+
fi
81+
done < <("$OPENSSL" crl -in "$crl" -text -noout | awk -F: '/Serial Number/ {print $2}')
82+
83+
if [ "$found" -ne 1 ]; then
84+
echo "revoked serial not found in $label CRL: $serial"
85+
return 1
86+
fi
87+
88+
local verify_out verify_rc
89+
verify_out=$("$OPENSSL" verify -CAfile "$ca_cert" -crl_check -CRLfile "$crl" \
90+
"$revoked_cert" 2>&1) || verify_rc=$?
91+
verify_rc=${verify_rc:-0}
92+
if [ "$verify_rc" -eq 0 ]; then
93+
echo "expected revoked verification failure for $label CRL"
94+
echo "$verify_out"
95+
return 1
96+
fi
97+
if ! echo "$verify_out" | grep -qi "revoked"; then
98+
echo "expected revoked verification failure for $label CRL"
99+
echo "$verify_out"
100+
return 1
101+
fi
102+
103+
if [ -n "$good_cert" ]; then
104+
if ! "$OPENSSL" verify -CAfile "$ca_cert" -crl_check -CRLfile "$crl" \
105+
"$good_cert" >/dev/null 2>&1; then
106+
echo "expected successful verification for $label CRL with $good_cert"
107+
return 1
108+
fi
109+
fi
110+
}
111+
112+
crl_rsa="certs/crl/crlRsaOut.pem"
113+
crl_ecc="certs/crl/crlEccOut.pem"
114+
115+
if [ ! -f "$crl_rsa" ] && [ ! -f "$crl_ecc" ]; then
116+
echo "skipping crl-gen-openssl.test: CRL outputs not found"
117+
exit 77
118+
fi
119+
120+
if [ -f "$crl_rsa" ]; then
121+
ca_rsa="certs/ca-cert.pem"
122+
revoked_rsa="certs/server-cert.pem"
123+
good_rsa="certs/client-ca-cert.pem"
124+
check_crl "$crl_rsa" "$ca_rsa" "$revoked_rsa" "$good_rsa" "RSA"
125+
fi
126+
127+
if [ -f "$crl_ecc" ]; then
128+
ca_ecc="certs/ca-ecc-cert.pem"
129+
revoked_ecc="certs/server-ecc.pem"
130+
good_ecc="certs/client-ecc-ca-cert.pem"
131+
check_crl "$crl_ecc" "$ca_ecc" "$revoked_ecc" "${good_ecc:-}" "ECC"
132+
fi
133+
134+
echo "crl-gen-openssl.test: OK"

0 commit comments

Comments
 (0)