Problem - Kevin Tafuro

In this recipe, we have used a number of functions from Recipes 9.1, 10.5, 10.7, and
10.8. These functions provide us with network connectivity and certificate verification.
We will only need the latter if we need to connect to an SSL-enabled web server
to retrieve the CRL, and it will all be handled by the network connectivity functions.
Note that we construct an X509_STORE object that contains any system-wide trusted
certificates as well as the issuing certificate for which we’re getting the CRL. For simplicity,
we assume that an SSL-enabled server that is serving the CRL will present this
same certificate. In practice, however, that is not always a safe assumption. Our testing
indicates that this assumption frequently holds true, but there is a problem: if we
are retrieving the CRLfrom an SSL-enabled server, we have to trust that the peer’s
certificate has not been revoked. Fortunately, this is a reasonably safe assumption for
us to make here because if a CA’s signing certificate has been revoked for some reason,
there are much bigger problems. *
We have provided code here to retrieve CRLs using HTTP because it is simple to
implement and is commonly used by CAs to distribute their CRLs; however, LDAP
is also commonly used for CRLdistribution. Unfortunately, owing to the complexity
of the solution, we don’t include a detailed discussion of that topic in this book.
LDAP is commonly used instead of the Directory Access Protocol (DAP) simply
because it is less cumbersome. Unfortunately, it lacks some of the features that make
storing CRLs and other PKI objects in a directory attractive. In particular, LDAP
does not support location transparency and uses referrals instead, but few LDAP client
implementations actually support referrals correctly. Because of the lack of location
transparency, LDAP does not scale as well as DAP, and it makes it more difficult
for CAs to interoperate.
From the standpoint of the client, using LDAP to retrieve CRLs adds complexity
without much benefit over other, simpler protocols such as HTTP. We feel that it’s
important to be aware of how common the use of LDAP is, and we leave it to you to
decide whether to include support for it in your own programs.
See Also
• RFC 3280: Internet X.509 Public Key Infrastructure Certificate and Certificate
Revocation List (CRL) Profile
• Recipes 7.16, 9.1, 10.1, 10.3, 10.5, 10.7, 10.8
* If the CA’s signing certificate has been revoked, it is still acceptable to trust the signature on the CRLif and
only if the signing certificate is also in the list of revoked certificates. Unfortunately, if it is not, there is no
way to know that the certificate has been revoked, so there is no choice but to accept it. If the CA’s signing
certificate has been revoked because of a compromise of the certificate’s corresponding private key, the party
responsible for the compromise could likely issue an invalid CRL. As you can see, this is a vicious circle and
only serves to demonstrate the flaws in CRLs that we discuss in Recipe 10.1.
Obtaining Certificate Revocation Lists with OpenSSL | 555
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.