Signature MetadataFilter, name, CA, CRL comparison

[Cantor, Scott]

On 12/20/11 12:13 PM, "Marc Thornton" <marc.thornton at gmail.com> wrote:

>Unfortunately, I seem to be stuck in a catch-22 based on the current
>implementation for CRL validation though. The certificates we are forced
>to deal with use a DirName CRL Distribution Point, which identifies a DN
>where that particular certificate's CRL can be downloaded (can be
>different for each certificate).

I definitely have no plans to support LDAP as a protocol for getting CRLs.
The branch now supports http/https.

> Since neither OpenSSL, nor Shibboleth support this extension, I have a
>process in place to periodically download the CRL and place it in a local
>file. In processing the StaticPKIX TrustEngine with this local CRL path
>and checkRevocation set to "entityOnly" or "fullChain", I get the
>following error in the logs:
>   OpenSSL [3]: path validation failure: unhandled critical CRL extension
>
>I am assuming it refers to the DirName CRL extension ie
>      X509v3 CRL Distribution Points:
>                DirName:

I don't know, I haven't encountered that. OpenSSL is not known for
rigrorousness when it validates paths, at least in most areas. In this
context, I don't really follow what it would be demanding somebody to do.
If there's an API in the OpenSSL validator for telling it that an
extension was "handled", I'm not aware of it. I can't see how else you
could "support" the extension. CRLs don't get handled by it directly, you
have to process CDPs yourself and then supply them as X509_CRL objects
directly. So I don't know what it would be asking for. I hesitate to say
you're wrong, but I don't see what I could do to "handle" this critical
extension.

>Short of a customization to the xml-tooling call to OpenSSL's verify_cert
>call to ignore missing "critical extensions", it seems I am out of luck
>on implementing CRL validation with this type of cert?

Maybe the problem is that those extensions aren't meant to be critical,
but I'm not the one to ask. Kaspar might be able to chime in, but I doubt
he reads the list often. Maybe somebody else at SWITCH could relay the
question.

-- Scott