1

I looked extensively online if this question was answered elsewhere and it was not.

When trying to use CRLs in the python openssl library, we are getting "certificate unknown" errors. Specifically, when the crl has a revocation of a cert that is not used in the handshake of the ssl connection, there is still an error. If instead an empty CRL is used, there is no error and the devices are able to complete a socket.connect()

Simple client/server model to illustrate problem:

Server:

def createServerSideSocket(port, backlog=5):
    context = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
    context.load_cert_chain(certfile="cert.pem", keyfile="key.pem", password='tempPassword')
    context.verify_flags = ssl.VERIFY_CRL_CHECK_LEAF  #specifying flag to check crl
    context.load_verify_locations(cafile = "crl.pem") #loading crl
    sock = socket.socket()
    sock.bind(('', port))
    sock.listen(backlog)    #listen on port 5000
    return sock, context

port = 5000
sock, context = createServerSideSocket(port)
newSocket, fromAddr = sock.accept()
connStream = context.wrap_socket(newSocket, server_side=True)
print(bytes.decode(connStream.recv(1024)))  #receive and print data

Client:

def createClientSideSocket(server_ip):
    context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH, cafile="cacert.pem")  
    context.verify_flags = ssl.VERIFY_CRL_CHECK_LEAF #specifying flag to check crl
    context.load_verify_locations("crl.pem") #loading crl
    conn = context.wrap_socket(socket.socket(), server_hostname=server_ip)
    return conn

conn = createClientSideSocket("192.168.1.7") #our IP address of the server
conn.connect(("192.168.1.7", 5000))
conn.sendall(str.encode("test data"))  

When crl.pem has 0 revoked certs, connection works. When crl.pem has any revocation (even for revocations not used in the handshake) it fails with the following error:

on client:

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:833)

on server:

[SSL: SSLV3_ALERT_CERTIFICATE_UNKNOWN] sslv3 alert certificate unknown (_ssl.c:777)
7
  • CRL objects are managed here/like that in PyopenSSL: pyopenssl.org/en/stable/api/crypto.html#crl-objects. You are not expected to do cafile = "crl.pem" this is counter ways, a CA certificate is not a CRL. A CRL lists all certificates that became invalid and should not be used anymore. Jul 5, 2018 at 17:23
  • @PatrickMevzek yeah, we use this library to create CRLs, but then to use them with ssl.py (the python ssl wrapper for python sockets) you need to point to the crl location according to docs.python.org/3/library/…
    – Joe N
    Jul 5, 2018 at 17:29
  • I stand corrected then indeed. But very poor API I think to mix CA and CRLs. I have just checked the Python 3.7 source code for this function, and it is really not clear that it does anything with CRLs... :-( It basically calls SSL_CTX_load_verify_locations with what it loaded from filesystem and this doc page openssl.org/docs/manmaster/man3/… does not speak at all about CRLs... Jul 5, 2018 at 17:41
  • yeah it is really poorly documented :(
    – Joe N
    Jul 6, 2018 at 13:48
  • Based on the source code I have seen, I see no way that it can work (with CRLs), so it is either far more magical than I understand or just not really implemented and the documentation is wrong. Jul 6, 2018 at 13:50

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.