Commit Graph

28 Commits

Author SHA1 Message Date
JacobBarthelmeh bbf3beef35 fix to free CRL reason extension 2026-03-13 16:17:52 -06:00
Hideki Miyazaki f59b9fd32e fix number in sh 2026-03-06 14:16:36 +09:00
Hideki Miyazaki 5ce86cff62 fix multi-test.sh failure 2026-03-06 10:53:52 +09:00
Hideki Miyazaki cfb7f35e72 fix lareger(>57 octets) crlnum 2026-03-06 10:51:54 +09:00
Paul Adelsbach ebda79fadb Fix OCSP->CRL fallback 2026-02-26 11:44:50 -08:00
Hideki Miyazaki 08876e278a Fix CRL Number hex string buffer overflow in CRL parser 2026-01-08 17:25:19 +09:00
Daniel Pouzzner 1c68da282c portability enhancement: use "#!/usr/bin/env <interpreter>" on all perl scripts and shell scripts that use bash extensions, and use "#!/bin/sh" on the rest. 2024-08-20 13:48:33 -05:00
JacobBarthelmeh cd07e32b13 update crl files and add in compat support for RSA-PSS 2024-01-08 16:38:11 -08:00
JacobBarthelmeh d58acef895 add RSA-PSS CRL test case 2024-01-05 14:47:53 -08:00
Juliusz Sosinowicz 7baf151c37 CRL verify the entire chain including loaded CA's
- Regen CRL's as most of them are expired
- certs/crl/extra-crls/ca-int-cert-revoked.pem: CRL that revokes certs/intermediate/ca-int-cert.pem signed by certs/ca-cert.pem
- Add CheckCertCRL_ex API to not depend on DecodedCert
- CheckCertCRLList: accept raw serial or hashed version to work with Signers
- Add XELEM_CNT to simplify pre-proc element counting
2023-10-03 11:45:43 +02:00
Juliusz Sosinowicz 57ce894393 CRL refactor
- CheckCertCRLList: check all entries in case a single issuer has multiple CRL's loaded
- test_multiple_crls_same_issuer: testing two different certificates forcing the client to check both CRL's from the same issuer
- CRL_Entry
  - use a lock instead of a mutex to allow multiple threads to access the same list simultaneously
  - add a verifyMutex when doing verification so that we don't have to release the crlLock
- Add allocation and free functions for CRL_Entry
- DupCRL_Entry: simplify copying by copying all static fields in one memcpy
2023-08-28 10:52:36 +02:00
Hideki Miyazaki 44a20c8ce6 add more unit test case for load_crl_file 2021-03-05 08:19:14 +09:00
David Garske 3be7eacea9 Added client/server certs and keys for P-384-bit signed by P-384 CA. Fix for broken certs/ecc/genecc.sh script. Added simple P-384 cipher suite test. 2018-10-25 09:21:27 -07:00
kaleb-himes dc942bf9cb Remove unnecessary duplicate revocation 2018-09-20 16:54:35 -06:00
kaleb-himes 54e04dd312 posix compliance enhancements for portability 2018-09-20 10:30:11 -06:00
kaleb-himes 4f6ee556dc Refactor the cert renewal scripts with error handling
Portability updates
2018-09-19 14:47:21 -06:00
Jacob Barthelmeh 1a7d208a60 add crl2.pem to renew certs script 2018-05-29 16:57:30 -06:00
Jacob Barthelmeh e41f5de556 default generate ed25519 cert with renew and add ecc crls to script 2018-03-09 14:09:34 -07:00
David Garske 024c8725ad Testing improvements for cert gen and TLS cert validation:
* Fixes to support certificate generation (`WOLFSSL_CERT_GEN`) without RSA enabled.
* Added new ECC CA for 384-bit tests.
* Created new server cert chain (ECC CA for 256-bit that signs server-ecc.pem)
* Created new `./certs/ecc/genecc.sh` script for generating all ECC CA's, generated server cert req (CSR), signing with CA and the required CRL.
* Moved the wolfCrypt ECC CA / ECC cert gen test into `ecc_test` as `ecc_test_cert_gen`.
* Refactor duplicate code that saves DER to disk, converts DER to PEM and saves PEM to disk into SaveDerAndPem function.
* Changed `ecc_test_make_pub` and `ecc_test_key_gen` to use XMALLOC for temp buffers (uses heap instead of stack).
* Cleanup to combine all certificate subject information into global `certDefaultName`.
* Updated cert request info to use wolfSSL instead of Yassl.
* Cleanup to combine keyUsage into `certKeyUsage` and `certKeyUsage2`.
* Re-number error codes in rsa_test.
* Moved the certext_test after the ecc_test, since it uses a file generated in `ecc_test_cert_gen`.
2017-10-19 16:17:51 -07:00
Nickolas Lapp 3732d31955 Fixed file cleanup in gencrls, finished support for crl.test update crls sign revoked cert 2015-07-22 10:37:24 -06:00
kaleb-himes d2de4719eb added way to gen revoked without running renewcerts 2015-07-22 09:31:23 -06:00
Nickolas Lapp 27202912e8 Adjusted gencrls and renewcerts to add a revoked server cert 2015-07-21 17:17:41 -06:00
kaleb-himes 9261aa1d6d crls updated 2015-02-02 11:24:30 -07:00
kaleb-himes bd1ff08aa9 certs name changes 2014-12-29 11:53:25 -07:00
Kaleb Himes 2f18af2f5f added --override-ntru, -h, -help, and error checking 2014-07-21 15:13:37 -06:00
John Safranek 9a275fbe8b updated CRLs for a year 2014-02-07 12:17:01 -08:00
toddouska 5e4c0c426c update test CRLs 2012-11-29 11:49:57 -08:00
toddouska 15fe7f4d94 update CRLs switch to 120 days, add gen script 2012-08-10 11:02:46 -07:00