[gnutls-devel] GnuTLS | pkcs11: respect Mozilla's time-based distrust upon issuer lookup (!1725)

[Read-only notification of GnuTLS library development activities]

Alexander Sosedkin commented on a discussion on lib/x509/verify.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1313472889

>  		goto cleanup;
>  	}
>  
> +	/* check if the raw issuer is assigned with a time-based
> +	 * distruct and the certificate is issued after that period
> +	 */
> +	distrust_after =
> +	    _gnutls_pkcs11_get_distrust_after(url, issuer,
> +					      purpose == NULL ?
> +					      GNUTLS_KP_TLS_WWW_SERVER :
> +					      purpose,
> +					      GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED);
> +	if (distrust_after != (time_t) - 1
> +	    && distrust_after <=
> +	    gnutls_x509_crt_get_activation_time(certificate_list
> +						[clist_size - 1])) {

Should we extend the check to the entire chain then? I do realize that this scenario doesn't seem super-practical, so I wonder whether there's guidance about that.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1313472889
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20230314/b6f404c3/attachment-0001.html>