[issue34078] Broken CRL functionality in ssl.py
New submission from Joe N nettijoe@gmail.com:
CRLs in ssl.py or at the documentation is broken. Specifically I think the documentation here is wrong: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_verify_locati...
Here is a stackoverflow post: https://stackoverflow.com/questions/51196492/how-to-use-crls-in-pyopenssl?no...
I made a very user friendly test suite of files to show how it is broken.
Run the code in here (follow readme instructions) to see the bug. https://github.com/nettijoe96/bugInSSL
---------- assignee: christian.heimes components: SSL messages: 321343 nosy: Joe N, christian.heimes, docs@python priority: normal severity: normal status: open title: Broken CRL functionality in ssl.py type: behavior versions: Python 3.6
_______________________________________ Python tracker report@bugs.python.org https://bugs.python.org/issue34078 _______________________________________
Christian Heimes lists@cheimes.de added the comment:
Cert revocation check is working fine for me. I've attached a demo script that uses badssl.com:
$ curl -O http://crl3.digicert.com/ssca-sha2-g5.crl $ openssl crl -in ssca-sha2-g5.crl -inform DER -out ssca-sha2-g5.pem.crl -outform PEM $ python3.7 testcrl.py Traceback (most recent call last): File "testcrl.py", line 19, in <module> s.connect(('revoked.badssl.com', 443)) File "/usr/lib64/python3.7/ssl.py", line 1141, in connect self._real_connect(addr, False) File "/usr/lib64/python3.7/ssl.py", line 1132, in _real_connect self.do_handshake() File "/usr/lib64/python3.7/ssl.py", line 1108, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate revoked (_ssl.c:1045)
openssl s_client:
$ cat /etc/pki/tls/cert.pem ssca-sha2-g5.pem.crl > combined.pem $ openssl s_client -connect revoked.badssl.com:443 -servername revoked.badssl.com -CAfile combined.pem | grep Verify Verify return code: 0 (ok) $ openssl s_client -connect revoked.badssl.com:443 -servername revoked.badssl.com -CAfile combined.pem -crl_check | grep Verify Verify return code: 23 (certificate revoked)
---------- Added file: https://bugs.python.org/file47679/testcrl.py
_______________________________________ Python tracker report@bugs.python.org https://bugs.python.org/issue34078 _______________________________________
Christian Heimes lists@cheimes.de added the comment:
No response in over two years. I'm closing the issue. Please feel free to reopen the issue with more information.
---------- resolution: -> out of date stage: -> resolved status: open -> closed
_______________________________________ Python tracker report@bugs.python.org https://bugs.python.org/issue34078 _______________________________________
participants (2)
-
Christian Heimes -
Joe N