proposal: crypto/tls: support for checking certificate chains against CRL revocation

[macb2625]

Proposal Details

Provide an external api which can take a list of CRL and X509 certificate chain/s and does CRL validation as done in the following code flow:
https://github.com/grpc/grpc-go/blob/master/security/advancedtls/advancedtls.go#L579
the pointer to CRLs can be part of x509 verify options as well which is used in certificate.Verify() call.
https://pkg.go.dev/crypto/x509#Certificate.Verify
https://pkg.go.dev/crypto/x509#VerifyOptions

[ianlancetaylor]

CC @golang/security

[gabyhelp]

Related Issues and Documentation

• crypto/x509: add ParseRevocationList, deprecate ParseCRL & ParseDERCRL #50674 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[introspection3]

goroutine leak

goroutine profile: total 7754
7687 @ 0x44066e 0x4393d7 0x472605 0x4e5a27 0x4e6d1a 0x4e6d08 0x539305 0x547545 0x7058fb 0x563578 0x705ade 0x702bef 0x709496 0x709497 0x7c212b 0x5d5663 0x5d5793 0x7c7e89 0x477fe1
#	0x472604	internal/poll.runtime_pollWait+0x84		D:/Go/src/runtime/netpoll.go:345
#	0x4e5a26	internal/poll.(*pollDesc).wait+0x26		D:/Go/src/internal/poll/fd_poll_runtime.go:84
#	0x4e6d19	internal/poll.(*pollDesc).waitRead+0x279	D:/Go/src/internal/poll/fd_poll_runtime.go:89
#	0x4e6d07	internal/poll.(*FD).Read+0x267			D:/Go/src/internal/poll/fd_unix.go:164
#	0x539304	net.(*netFD).Read+0x24				D:/Go/src/net/fd_posix.go:55
#	0x547544	net.(*conn).Read+0x44				D:/Go/src/net/net.go:179
#	0x7058fa	crypto/tls.(*atLeastReader).Read+0x3a		D:/Go/src/crypto/tls/conn.go:806
#	0x563577	bytes.(*Buffer).ReadFrom+0x97			D:/Go/src/bytes/buffer.go:211
#	0x705add	crypto/tls.(*Conn).readFromUntil+0xdd		D:/Go/src/crypto/tls/conn.go:828
#	0x702bee	crypto/tls.(*Conn).readRecordOrCCS+0x3ce	D:/Go/src/crypto/tls/conn.go:626
#	0x709495	crypto/tls.(*Conn).readRecord+0x155		D:/Go/src/crypto/tls/conn.go:588
#	0x709496	crypto/tls.(*Conn).Read+0x156			D:/Go/src/crypto/tls/conn.go:1370
#	0x7c212a	net/http.(*connReader).Read+0x14a		D:/Go/src/net/http/server.go:789
#	0x5d5662	bufio.(*Reader).fill+0x102			D:/Go/src/bufio/bufio.go:110
#	0x5d5792	bufio.(*Reader).Peek+0x52			D:/Go/src/bufio/bufio.go:148
#	0x7c7e88	net/http.(*conn).serve+0x748			D:/Go/src/net/http/server.go:2074