Signature MetadataFilter, name, CA, CRL comparison

[Marc Thornton]

>
> CRLs don't get handled by it directly, you
> have to process CDPs yourself and then supply them as X509_CRL objects
> directly. So I don't know what it would be asking for. I hesitate to say
> you're wrong, but I don't see what I could do to "handle" this critical
> extension.


I dug in a bit further and it seems to be an unsupported extension on the
CRL contents itself (not the certificate), the issuerDistributionPoint,
which is explicitly marked as critical:

CRL extensions:
            X509v3 Issuing Distrubution Point: critical

OpenSSL 0.9.8e, which is the default on RedHat Linux 5, doesn't even read
the contents of the extension correctly. Based on some anecdotal
information, it's possible that OpenSSL 1.x may actually read the details
correctly but to determine whether it would handle it or match it with
distribution point identified in the certificate would require additional
investigation.  Change notes on the OpenSSL site for version 1.0.0 seem to
identify that full support for this extension is in progress:

"Partial support for Issuing Distribution Point CRL extension. CRLs partitioned
by DP are handled but no indirect CRL or reason partitioning (yet).
Complete overhaul of CRL handling: now the most suitable CRL is selected
via a scoring technique which handles IDP and AKID in CRLs."

How thrilling :P
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111220/b7daea4b/attachment.html