OpenSSL::X509::CRL class doesn't load revoked entries correctly

Question

OpenSSL::X509::CRL class doesn't load revoked entries correctly

bkerley opened this issue 10 years ago · comments

Bryce "BonzoESC" Kerley commented 10 years ago

I have a revoked.crl Certificate Revocation List with six entries (see https://gist.github.com/2790b2c1ac1a7af55240 ), and while OpenSSL::X509::CRL on Ruby 2.1.2 can read it, the same code on JRuby 1.7.13 on OS X cannot:

require 'pp'
require 'openssl'

crl_data = File.read './revoked.crl'
pp crl_data
crl = OpenSSL::X509::CRL.new crl_data
pp crl.revoked

Expected:

"-----BEGIN X509 CRL-----\nMIICATCCAasCAQEwDQYJKoZIhvcNAQEFBQAwYTELMAkGA1UEBhMCVVMxEDAOBgNV\nBAgMB0Zsb3JpZGExDjAMBgNVBAcMBU1pYW1pMRwwGgYDVQQKDBNyNTA5LWNlcnQt\ndmFsaWRhdG9yMRIwEAYDVQQDDAlsb2NhbGhvc3QXDTE0MDcwNzE3MzEzNVoXDTI0\nMDcwNDE4MzEzNVowgeQwJAITBj4XOQip5iM9jsjNahP+ln2bNhcNMTQwMjExMTU0\nMjMyWjAkAhMGPhffXa7qnjiOsKG+T59MXoICFw0xNDAyMTExNjE5MjNaMCQCEwY+\nG/iZDaYOYqQNkUhWz2VDQQYXDTE0MDIxMTIwMTE0OVowJAITBj4b+xUAmYEJh7F0\nEk7YjFlzhhcNMTQwMjExMjAxMjIyWjAkAhMGPhv+d3hbmVhej514YzyCQvIOFw0x\nNDAyMTEyMDEzMDdaMCQCEwZMlT4VU+7hoQBdGcEGWKf/tEYXDTE0MDcwNzE4MzEz\nNVqgLzAtMAoGA1UdFAQDAgEGMB8GA1UdIwQYMBaAFJg2dyTKjan/rPrS2dVd1VDm\n92pRMA0GCSqGSIb3DQEBBQUAA0EASi1yCsP5ZphMI7XsTE65XwB9ABNcP36UHtdV\nm9iz/ZQpSeFoTlokJyy6c4+fVVIiDDUbOOAdN0RWmgEqkhLCYA==\n-----END X509 CRL-----\n"
[#<OpenSSL::X509::Revoked:0x007f944b1fd150>,
 #<OpenSSL::X509::Revoked:0x007f944b1fd100>,
 #<OpenSSL::X509::Revoked:0x007f944b1fd0d8>,
 #<OpenSSL::X509::Revoked:0x007f944b1fd0b0>,
 #<OpenSSL::X509::Revoked:0x007f944b1fd088>,
 #<OpenSSL::X509::Revoked:0x007f944b1fd038>]

Actual:

"-----BEGIN X509 CRL-----\nMIICATCCAasCAQEwDQYJKoZIhvcNAQEFBQAwYTELMAkGA1UEBhMCVVMxEDAOBgNV\nBAgMB0Zsb3JpZGExDjAMBgNVBAcMBU1pYW1pMRwwGgYDVQQKDBNyNTA5LWNlcnQt\ndmFsaWRhdG9yMRIwEAYDVQQDDAlsb2NhbGhvc3QXDTE0MDcwNzE3MzEzNVoXDTI0\nMDcwNDE4MzEzNVowgeQwJAITBj4XOQip5iM9jsjNahP+ln2bNhcNMTQwMjExMTU0\nMjMyWjAkAhMGPhffXa7qnjiOsKG+T59MXoICFw0xNDAyMTExNjE5MjNaMCQCEwY+\nG/iZDaYOYqQNkUhWz2VDQQYXDTE0MDIxMTIwMTE0OVowJAITBj4b+xUAmYEJh7F0\nEk7YjFlzhhcNMTQwMjExMjAxMjIyWjAkAhMGPhv+d3hbmVhej514YzyCQvIOFw0x\nNDAyMTEyMDEzMDdaMCQCEwZMlT4VU+7hoQBdGcEGWKf/tEYXDTE0MDcwNzE4MzEz\nNVqgLzAtMAoGA1UdFAQDAgEGMB8GA1UdIwQYMBaAFJg2dyTKjan/rPrS2dVd1VDm\n92pRMA0GCSqGSIb3DQEBBQUAA0EASi1yCsP5ZphMI7XsTE65XwB9ABNcP36UHtdV\nm9iz/ZQpSeFoTlokJyy6c4+fVVIiDDUbOOAdN0RWmgEqkhLCYA==\n-----END X509 CRL-----\n"
[]

Bryce "BonzoESC" Kerley · Answer 1 · Tue Aug 19 2014 01:03:40 GMT+0800 (China Standard Time)

Failing test case has been added at https://github.com/bkerley/jruby-openssl/tree/bk-crl-loading

Karol Bucek · Answer 2 · Mon Sep 08 2014 23:23:42 GMT+0800 (China Standard Time)

226aba5 should do it ... thanks!