Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CRL revocation reasons incorrect in documentation #397

Closed
FractalBoy opened this issue Jun 29, 2022 · 0 comments · Fixed by #412
Closed

CRL revocation reasons incorrect in documentation #397

FractalBoy opened this issue Jun 29, 2022 · 0 comments · Fixed by #412

Comments

@FractalBoy
Copy link
Contributor

Documentation says:

Net::SSLeay::P_X509_CRL_add_revoked_serial_hex($crl, $serial_hex, $rev_time, $reason_code, $comp_time);
# $crl - value corresponding to openssl's X509_CRL structure
# $serial_hex - string (hexadecimal) representation of serial number
# $rev_time - (revocation time) value corresponding to openssl's ASN1_TIME structure
# $reason_code - [optional] (integer) reason code (see below) - default 0
# $comp_time - [optional] (compromise time) value corresponding to openssl's ASN1_TIME structure
#
# returns: no return value
 
reason codes:
0 - unspecified
1 - keyCompromise
2 - CACompromise
3 - affiliationChanged
4 - superseded
5 - cessationOfOperation
6 - certificateHold
7 - removeFromCRL

The correct values (from RFC 5280) are:

 CRLReason ::= ENUMERATED {
        unspecified             (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
             -- value 7 is not used
        removeFromCRL           (8),
        privilegeWithdrawn      (9),
        aACompromise           (10) }

Note that there is no value 7. This is different from reason flags on page 47 of RFC 5280:

ReasonFlags ::= BIT STRING {
        unused                  (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
        privilegeWithdrawn      (7),
        aACompromise            (8) }

In my testing, the P_X509_CRL_add_revoked_serial_hex uses the first set of values.

h-vn added a commit that referenced this issue Dec 23, 2022
…ked_serial_hex.

SSLeay.pod incorrectly listed CRL DistributionPoint ReasonFlags as values for
certificate revocation reason.
@h-vn h-vn closed this as completed in #412 Dec 23, 2022
h-vn added a commit that referenced this issue Dec 23, 2022
…ked_serial_hex.

SSLeay.pod incorrectly listed CRL DistributionPoint ReasonFlags as values for
certificate revocation reason.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant