Fwd: Intermediate CA revocation

[Wes Malone]

Hello all,

Why should the Openssl CMS image signing revocation list only check
leaf certificates? Current documentation states

> Revocation is only checked against the signer certificate. Revoking an
> intermediate CA in the trust chain would require the
> X509_V_FLAG_CRL_CHECK_ALL verification flag, which SWUpdate does not
> currently set.

If I have an intermediate certificate that is revoked and included on my CRL:
my_root
-> intermediate_1 (revoked!)
-> leaf_1 (revoked!)
-> leaf_2 (newly created)

why should swupdate allow leaf_2 to be valid?

Maybe there is a reason I am missing that we shouldn't add CHECK_ALL?

- if (!X509_STORE_set_flags(castore, X509_V_FLAG_CRL_CHECK)) {
+ if (!X509_STORE_set_flags(castore, X509_V_FLAG_CRL_CHECK |
X509_V_FLAG_CRL_CHECK_ALL)) {

I can send this simple patch if you agree.

Wes Malone

[Stefano Babic]

Hi Wes,

On 8/3/26 23:46, Wes Malone wrote:
> Hello all,
>
> Why should the Openssl CMS image signing revocation list only check
> leaf certificates? Current documentation states
>
>> Revocation is only checked against the signer certificate. Revoking an
>> intermediate CA in the trust chain would require the
>> X509_V_FLAG_CRL_CHECK_ALL verification flag, which SWUpdate does not
>> currently set.

I am aware of this but I do not know which are the intentions of the
authors of the patch and which is their use case to explicitly allow
intermediate certificates. Added Daniel / Frank in CC, they can explain
the motivation.

>
> If I have an intermediate certificate that is revoked and included on my CRL:
> my_root
> -> intermediate_1 (revoked!)
> -> leaf_1 (revoked!)
> -> leaf_2 (newly created)
>
> why should swupdate allow leaf_2 to be valid?
>
> Maybe there is a reason I am missing that we shouldn't add CHECK_ALL?
>
> - if (!X509_STORE_set_flags(castore, X509_V_FLAG_CRL_CHECK)) {
> + if (!X509_STORE_set_flags(castore, X509_V_FLAG_CRL_CHECK |
> X509_V_FLAG_CRL_CHECK_ALL)) {
>
> I can send this simple patch if you agree.
>

Yes - if Daniel / Frank have a use case to do in this way, we need then
a configuration to enable / disable the mechanism.

Best regards,
Stefano Babic


--
_______________________________________________________________________
Nabla Software Engineering GmbH
Hirschstr. 111A | 86156 Augsburg | Tel: +49 821 45592596
Geschäftsführer : Stefano Babic | HRB 40522 Augsburg
E-Mail: sba...@nabladev.com