{"push_id":2601579993,"size":1,"distinct_size":1,"ref":"refs/heads/fix_crl_checking","head":"89f8ddcf306c6587e14f7ed42afd19e20e8ef999","before":"2429d4516df044ebb13569705dd938d73b9096ec","commits":[{"sha":"89f8ddcf306c6587e14f7ed42afd19e20e8ef999","author":{"name":"David Cooper","email":"2388ab39fb72c677f52d03cac80a644cb935035f@gmail.com"},"message":"Fix some problems with CRL revocation checking\n\nThere are some circumstances in which check_revocation_crl() will incorrectly indicate that a CRL lists the server's certificate as revoked. #1046 is one of them. Another is any case in which the server's certificate cannot be validated using any of the certificates in the trust store that OpenSSL uses (e.g., the server's certificate was issued by a local CA). In both of these cases, \"openssl verify\" fails, for some reason other than \"certificate revoked\", and check_revocation_crl() assumes that any failure of \"openssl verify\" is the result of certificate revocation.\n\nThis PR addresses the problem in two ways. First, it adds the \"-partial_chain\" option to the \"openssl verify\" command line whenever $OPENSSL supports that option (it is not supported by LibreSSL or by versions of OpenSSL earlier than 1.0.2). This will fix most of the problems when a version of OpenSSL that supports \"-partial_chain\" is used.\n\nEven if the \"-partial_chain\" option is provided, OpenSSL needs to have at least one CA certificate so that it can get the public key needed to verify the signatures on the server's certificate and on the CRL. So, if the server doesn't send any CA certificates and the server's certificate was not issued by a CA in the trust store, then the verify command will fail even if the \"-partial_chain\" option is provided.\n\nSo, as a fail-safe, this PR changes check_revocation_crl() to check the error message that the verify command provides when it fails so that testssl.sh only reports a certificate a revoked if the verify command fails with a reason of \"certificate revoked\".\n\nNote that this PR also fixes two other minor issues. It incorporates #1047, which corrects a typo, and it redirects $OPENSSL's output on line 1479 in order to suppress any error messages that $OPENSSL might print (e.g., \"WARNING: can't open config file\").","distinct":true,"url":"https://api.github.com/repos/dcooper16/testssl.sh/commits/89f8ddcf306c6587e14f7ed42afd19e20e8ef999"}]}
{"actor":{"display_login":"dcooper16"}}