Nsryjdtyk

Here's pkcs7_verify signature taken from C/C++ library:

int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,

             BIO *indata, BIO *out, int flags);

It can be used with PKCS7 block (p7) and the section that it suppose to sign (in data).

I wonder how does this check detect if one of the certificate in the chain is revoked...

From what I know, revocation check can be made only if matching against another certificate outside the pkcs7 block, which is marked as revoked.

I checked the function arguments and found one that represent the list of store trusted certificates.

This arg should hold the certificate which is the issuer of the lower-most certificate in the pkcs7 chain. So my guess is that if this certificate is marked as revoked, we fail the check on revocation reason...

But what if another certificate higher in the chain is revoked ? how do I provide this piece of information to pkcs7_verify ?

Or perhaps there's another openssl method that decide if a certificate in the chain is revoked or not ?

UPDATE:

I've found an alternative way to check whether a certificate is revoked. In the example below we can see that revoked_test.pem is identified as revoked by matching against the list in crl_chain.pem. How can I do it programmatically ?

openssl verify -crl_check -CAfile crl_chain.pem revoked-test.pem 

revoked-test.pem: OU = Domain Control Validated, OU = PositiveSSL, CN = xs4all.nl

error 23 at 0 depth lookup:certificate revoked

thanks

Most of the rules of the certification path validation is set in the X509_STORE structure you are passing to the PKCS7_verify function.

This example show how to build a complete X509_STORE and explain how to activate the CRL validation in the X509_STORE. (the example is good for setting up the crl validation but not for the certificate chain handling)

The core functions are:

• X509_STORE_set_flags


• 
  X509_STORE_add_crl


• X509_STORE_add_lookup

You use the X509_STORE_set_flags to tell the certificate store to perform CRL validation. The flags you need are: X509_V_FLAG_CRL_CHECK_ALL | X509_V_FLAG_CRL_CHECK. You can find all flags here.

You use theX509_STORE_add_crl to add CRLs for the validation. The CRL doesn't need to be from a root CA.

As an option to theX509_STORE_add_crl, you have the X509_STORE_add_lookup, to add a function to lookup for CRLs in any place (e.g.: file system, database, urls, etc.).

When performing the chain validation, OpenSSl will use the CRLs and lookup functions in the X509_STORE to validate all certificates in the chain. If any certificate in the chain is revoked, an error is returned.

It's important to add that the X.509 certification path validation specification doesn't include the validation of trust anchors (usually root certificates). All certificates in the chain under the trust anchor have to be verified, but the trust anchor is trusted because the verifier set it as so (i.e.: the trust anchor validation is made out-of-bounds by the verifier).