OpenSSL – Check SSL Certificate Against CRL with Intermediate CA

crlopenssl

I am trying to understand how to check an SSL certificate, taking into account any relevant published CRL when the certificate chain is the following:

Root CA (with no CRL distribution points)
- Intermediate CA (advertising a CRL distribution point signed by the root CA)
  - Website certificate (advertising a CRL DP signed by the intermediate CA)

So, two CRL lists need to be checked.

It happens that BBC's website is configured as indicated above, so let's take this as an example. The files that I used are at the end of this question.

When I try to verify the certificate without checking the CRL, it's fine:

$ openssl verify -CAfile intermediate_fullchain.pem bbc.pem
bbc.pem: OK

When I try to check the CRL from the CRL URLs given in the certificates, I get an error:

$ openssl verify -crl_download -crl_check_all -CAfile intermediate_fullchain.pem bbc.pem
Error loading CRL from http://crl.globalsign.com/gsrsaovsslca2018.crl
C = GB, ST = London, L = London, O = British Broadcasting Corporation, CN = www.bbc.com
error 3 at 0 depth lookup: unable to get certificate CRL
error bbc.pem: verification failed

This makes sense to me as the crl files are in DER format while openssl wants PEM format, so let's download the CRLs and convert them to PEM. The CRL URLs can be found using:

$ openssl x509 -in bbc.pem -text -noout
$ openssl x509 -in intermediate_fullchain.pem -text -noout

Then, I did:

$ wget -O intermediate_crl.der http://crl.globalsign.com/gsrsaovsslca2018.crl
$ openssl crl -inform DER -in intermediate_crl.der -outform PEM -out intermediate_crl.pem
$ wget -O root_crl.der http://crl.globalsign.com/root-r3.crl
$ openssl crl -inform DER -in root_crl.der -outform PEM -out root_crl.pem

Now, I thought I had everything I need to validate the certificate:

$ openssl verify -crl_check_all -CRLfile intermediate_crl.pem -CRLfile root_crl.pem -CAfile intermediate_fullchain.pem bbc.pem
OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
error 3 at 2 depth lookup: unable to get certificate CRL
error bbc.pem: verification failed

But, No! Verification still fails. My questions:

What exactly is the issue in the command above? Does it mean OpenSSL expects the root CA to have a CRL?
What is the right way to check the certificate against the two CRLs advertised in the CA chain?

Files

bbc.pem: the webserver certificate:

intermediate_fullchain.pem: the intermediate CA certificate, with the chain to the root CA:

Best Answer

The intermediate_fullchain.pem file doesn't contain a self-signed root. I had to download the correct one from GlobalSign, although your machine may have it installed, in which case you simply need to remove the wrong intermediate from the above chain file.

You can view your intermediates with:

openssl crl2pkcs7 -nocrl -certfile intermediate_chain.pem | openssl pkcs7 -print_certs -noout

which gives:

subject=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign RSA OV SSL CA 2018
issuer=/OU=GlobalSign Root CA - R3/O=GlobalSign/CN=GlobalSign

subject=/OU=GlobalSign Root CA - R3/O=GlobalSign/CN=GlobalSign
issuer=/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA

You need to replace the 2nd certificate in the chain with the Root CA certificate or remove it if your system has the Root installed. It is this one that causes openssl verify to fail to find the CRL and therefore give you the error.

You can confirm the chain using the Subject and Authority Key Identifier extensions. The Authority Key Identifier (AKI) of a certificate should be the Subject Key Identifier (SKI) of its signer (the CA). Therefore the AKI of the top-level BBC certificate is F8:EF:7F:F2:CD:78:67:A8:DE:6F:8F:24:8D:88:F1:87:03:02:B3:EB which is the SKI of the C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018 intermediate CA. The AKI of that CA certificate is 8F:F0:4B:7F:A8:2E:45:24:AE:4D:50:FA:63:9A:8B:DE:E2:DD:1B:BC which is the SKI of OU=GlobalSign Root CA - R3, O=GlobalSign, CN=GlobalSign - the Root CA linked in the first paragraph above.

However, to confuse matters, the 2nd intermediate certificate in your file also has a SKI and Subject which is the same as the root linked above, but isn't self-signed. The AKI of that certificate is that of another Root CA certificate which you probably have in your trust-anchor store (my older test system doesn't have it, hence why it failed for me). Without downloading the linked Root CA certificate, your path is therefore 4 certificates long (1 end-entity, 2 intermediates, and a root), which would therefore need three CRLs - the root's and one issued by each intermediate.

With the correct linked Root, I get:

openssl verify -crl_check_all -CRLfile all_crl.pem -CAfile intermediate_fullchain.pem bbc.pem
bbc.pem: OK

If you were to find the third CRL, then you should get the same result.

Files

Best Answer

Related Solutions

Why can I not parse the certificate signing request with openssl on the Windows workstation

Verifying S/MIME signed message with OpenSSL without checking the certificate’s purpose

Related Topic