Closed TheRedTrainer closed 5 years ago
Fixed at fb30fcc. An OpenSSL function was being used (X509_STORE_CTX_set0_crls) but not in the right way; this function still needs some flags (_X509_V_FLAG_CRLCHECK) sent as parameters to use the CRLs that were set.
That option was the first one to use, but some other errors happened; so instead of that the validation is done "manually" (look for the serial number of the certificate in the corresponding CRL).
Verified. If any element from the repository (CA cert, ROA, MFT, GBR) was revoked by its CA, the element is not considered by the repository validation, throwing the following error:
ERR: rsync://localhost/repository/testnic-mft.mft: Certificate validation failed: certificate revoked
If an issuer revokes a CA or an EE cert from a repository, the corresponding CAs, ROAs and MFTs are processed as valid ones. According to RFC 6487 , these CAs, ROAs and MFTs from a revoked cert should be ignored: