Re: Re: CRL verification problem

You're correct that the same should apply for CRLs as Certificates,
however we went with Sun's opinion on this one as the number CA's that
seemed incapable of releasing correct certificates seemed overwhelming.

Please ask the CA in question to correct their certificates. Given what
has happened elsewhere it seems inevitable that one day this "feature"
will need to be removed, and if it is in response to someone discovering
an exploit it will happen really fast. All they need to do is not issue
BOOLEAN true.

Actually, thinking about it, we should probably add a system property
for this now, but at any rate, if we were to fix this, the client
certificate would no longer verify.

Regards,

David

On 14/12/19 3:16 am, luizurias wrote:
> Ok, i understand.
>
> But i have found out that this behavior does not apply in certificates.=
=2E
>
> This certificate (below) encodes critical value (false) in
> authorityKeyIdentifier, for example.=20
> When i verify if CA issued this certificate, the verification returns t=
rue.
> And, the tbsCertificate parsed by BC includes the critical value of fal=
se.
>
> We think that both certificate and CRL should have the same behavior, s=
ince
> the Extension structure is the same for both cases, no?
>
> CA certificate:
> MIIGkjCCBHqgAwIBAgIBATANBgkqhkiG9w0BAQ0FADBxMQswCQYDVQQGEwJCUjET
> MBEGA1UECgwKSUNQLUJyYXNpbDE0MDIGA1UECwwrQXV0b3JpZGFkZSBDZXJ0aWZp
> Y2Fkb3JhIFJhaXogQnJhc2lsZWlyYSB2NTEXMBUGA1UEAwwOQUMgUHJvZGVtZ2Ug
> QlIwHhcNMTgwODMxMTUyMDMzWhcNMjkwMzAxMTUyMDMzWjBUMQswCQYDVQQGEwJC
> UjETMBEGA1UEChMKSUNQLUJyYXNpbDEXMBUGA1UECxMOQUMgUHJvZGVtZ2UgQlIx
> FzAVBgNVBAMTDkFDIFByb2RlbWdlIE1HMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
> MIICCgKCAgEApWGLOCwpZr3PpyxVMR6x+os6/i3v2FOgEh8/8/bfUkv7qrIAfuy0
> Bqre/F+ZVVAnySqXObEMpQAtovqgLBEzzv1dcPyd6FLjHCqyuPNzRQLACAtEZJ/U
> A7pyKDiDspGwS0FyEYfMbxC7U0nuQnliJmANPJuc6SrAnnWBT7aimDI1ztxoJfCc
> lLVPZI/gft5uKK06p3wnsJvTZDYivvr45Vmf9715e0lvaad70qdE9YJZjQS0QWES
> I5iMwlTc+nx/Tpn7JmEwkNxS1K2n8EA6NxahnYQAjmNMrlnKkCd8nWi9WxE66ZSs
> spVyf+lNJlSnLX9hgRpiA5VsRafHSP3/vWNQaDpyaax88PIBfHilBMfSErFIEywR
> EcZnrv5egdGD8AO+EDLjW0m8pBrK2Qxak6NAM6ezMdpAwY2Uwp4z9fpuS3iIlFJS
> OCgS2MMBD8J2kplc71kM8EH8Mz4N2ji1SCLoG3NcqPD+GMIxE4F70pnHeOmW24qc
> sFVJCwDPaSZsoAA4fFH3m8PBpzLigvz9U0xURyr8n3jvI38KxS5Q+cH+SjGa5fQ6
> 6xn7BAhClheWeugbv/ljjciHzH5Qu4MbFdcGygBdiqRiMJOIWId8c/h5YZ0lmnAN
> vBmkcI3/+NlvsXiubE8z6yiDo3PwR95SfqNQzkgrcykicL9OfVNqUgsCAwEAAaOC
> AVAwggFMMB0GA1UdDgQWBBTt3CdtYXrn45x/fqKxU59wk3wCtjAPBgNVHRMBAf8E
> BTADAQH/MA4GA1UdDwEB/wQEAwIBBjB8BgNVHSAEdTBzMHEGBWBMAQF+MGgwZgYI
> KwYBBQUHAgEWWmh0dHA6Ly9pY3AtYnJhc2lsLmFjLnByb2RlbWdlLmdvdi5ici9y
> ZXBvc2l0b3Jpby9kcGMvYWNfcHJvZGVtZ2VfbWcvZHBjX2FjX3Byb2RlbWdlX21n
> LnBkZjBrBgNVHR8EZDBiMGCgXqBchlpodHRwOi8vaWNwLWJyYXNpbC5hYy5wcm9k
> ZW1nZS5nb3YuYnIvcmVwb3NpdG9yaW8vbGNyL2FjX3Byb2RlbWdlX2JyL2xjcl9h
> Y19wcm9kZW1nZV9ici5jcmwwHwYDVR0jBBgwFoAUyMgWTsRchBF6HLmDfFMdz27A
> I8kwDQYJKoZIhvcNAQENBQADggIBAI7GDU0ySaT9DG+ovEd7xp4Qxw9RgypvP9qW
> 0dLn2KPXtrSYJLFIOB+dIVp6wcAdotMXFqmdcVc0i4zkQu3S0MzkFCMdXmGTGjf4
> TbeUdUB9HGRZfyOP3FgfcX3foP3MFkI+acNAEqE7ntlngT6lowWA9B9CbGim1Ftg
> Kwo8AmcI7089mFUOaYAxhqyfuWHZtLHqYW+R0vuhkObSMHjQU2EIBCC69QlmGHgL
> Qa3PmNuQJWDvm8h+5XD3qqjnyg8h7PlBxPtOrpVip8a2zdz3fsBMV/cq8ssbwRvw
> cEcfu6vpyp8kpSHhUgVLCk7f5xfD35qlFeN9YAP8/n0vS85sqYKxUPKmm/HQQ8AL
> JRc32A5emksUw2snpJLeGvY/A8fC61YLq6KonLhVBt+nqHPPykD4BRa0qJw6Dq9t
> HLefim22LQzRzbOFnRpFDYYJfkwNQen5f3xwUzzx4UJsruQLR53BE8ocpeiB9+iY
> gmn4e+DcQKYM/HI0ha0zseX6xnDJeANg1JYbO4Jprb4cw26XkM+NDGkIC3FM4yJ/
> EtufNwOykEiG9ELCpou+ay8nnNXM0MKzMLiKmPjllY8rN84k309jHACy0RAbrCMf
> RXW3FZlBCKEfqpwOloJzBtDA10S6tplStVYjApy785Dr1B463CC1f+aow15/FirH
> hUh4GtCy
>
> User certificate:
> MIIHdDCCBVygAwIBAgICBaowDQYJKoZIhvcNAQELBQAwVDELMAkGA1UEBhMCQlIx
> EzARBgNVBAoTCklDUC1CcmFzaWwxFzAVBgNVBAsTDkFDIFByb2RlbWdlIEJSMRcw
> FQYDVQQDEw5BQyBQcm9kZW1nZSBNRzAeFw0xOTAzMDcxNDIxNTVaFw0yMjAzMDYx
> NDIxNTVaMIGNMQswCQYDVQQGEwJCUjETMBEGA1UEChMKSUNQLUJyYXNpbDEjMCEG
> A1UECxMaQXV0ZW50aWNhZG8gcG9yIEFSIENFTEVQQVIxGzAZBgNVBAsTEkFzc2lu
> YXR1cmEgVGlwbyBBMzEnMCUGA1UEAxMeRkVMSVBFIEpPU0UgVklESUdBTCBET1Mg
> U0FOVE9TMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnvgAEdySlCw
> N3OQkrRKn5AdfkjY9Jce8RJncQRv88w1oDyLC50dhNuxipLI39prpPRyl53O2SSx
> lWa6RhEsPcCxxTIjUomxjActrb9N9jlDFNJkH2fGzkW2XkHroCFyX0sw01rtehbP
> 5LrV9q3CZAwWNA5qLDhsChiKcy6eVvRN7zDBRNUUs8L2iq7FCmnvFHV874HPCIZk
> c+0/e9Bv5YfE/2XAHgga21we2BDT4P3YU3bfB/gWL6d1LO5wA5qwcXybV2n+ZPj8
> RVUDiAvieYUrnkjWhc7rAtHC3K24Aki7A//rB+JUxqmeNatCmgxZ4ms/wgj4QVbe
> pT2oh+gm5QIDAQABo4IDFDCCAxAwgbAGA1UdEQSBqDCBpaA+BgVgTAEDAaA1BDMw
> NzA5MTk1MTI3MTcwNzY0NzY4MDAwMDAwMDAwMDAwMDAwMDAwMTg0MDI4MzFTRVNQ
> UFKgFwYFYEwBAwagDgQMMDAwMDAwMDAwMDAwoB4GBWBMAQMFoBUEEzAwMDAwMDAw
> MDAwMDAwMDAwMDCBKmZlbGlwZS52aWRpZ2FsQHBhcmFuYXByZXZpZGVuY2lhLnBy
> Lmdvdi5icjAOBgNVHQ8BAf8EBAMCBeAwgYAGA1UdIAEBAAR2MHQwcgYGYEwBAgNa
> MGgwZgYIKwYBBQUHAgEWWmh0dHA6Ly9pY3AtYnJhc2lsLmFjLnByb2RlbWdlLmdv
> di5ici9yZXBvc2l0b3Jpby9kcGMvYWNfcHJvZGVtZ2VfbWcvZHBjX2FjX3Byb2Rl
> bWdlX21nLnBkZjAiBgNVHSMBAQAEGDAWgBTt3CdtYXrn45x/fqKxU59wk3wCtjCB
> 0gYDVR0fAQEABIHHMIHEMGCgXqBchlpodHRwOi8vaWNwLWJyYXNpbC5hYy5wcm9k
> ZW1nZS5nb3YuYnIvcmVwb3NpdG9yaW8vbGNyL2FjX3Byb2RlbWdlX21nL2xjcl9h
> Y19wcm9kZW1nZV9tZy5jcmwwYKBeoFyGWmh0dHA6Ly9pY3AtYnJhc2lsMi5hY3By
> b2RlbWdlLmNvbS5ici9yZXBvc2l0b3Jpby9sY3IvYWNfcHJvZGVtZ2VfbWcvbGNy
> X2FjX3Byb2RlbWdlX21nLmNybDAgBgNVHSUBAQAEFjAUBggrBgEFBQcDAgYIKwYB
> BQUHAwQwIAYDVR0OAQEABBYEFPjoyfFyW+obqvKFB/MhAj6Hq0efMH0GCCsGAQUF
> BwEBAQEABG4wbDBqBggrBgEFBQcwAoZeaHR0cDovL2ljcC1icmFzaWwuYWMucHJv
> ZGVtZ2UuZ292LmJyL3JlcG9zaXRvcmlvL2NlcnRpZmljYWRvL2FjX3Byb2RlbWdl
> X21nL2FjX3Byb2RlbWdlX21nLnA3YzAMBgNVHRMBAQAEAjAAMA0GCSqGSIb3DQEB
> CwUAA4ICAQAepVXrOthti6StNxgS8nK73bpdlSrt7cmF/YbPek6kNzxKsmVk5jnR
> F9unE33LQBTeG1yk+4wZKcsdig1c5ACvt4x26Luj8xxX1qnMYE6qolvaXfUNm41t
> A88FzxqyO0OjOtXVbYuP40AW/yTCKhEATvqW70cC9FiTsX1On/sdN86K9YdUOWph
> 9HE9aPFK2OnvT8FUpr9obQNkZuoCQc+STBWRgFSn39GFivzDEErpgkWtCnrN9pWV
> QXVw9sV4y09g0vWonihyBvWCzvT0V1/w5ng0jeFPW0dfPm/P6UPA0eGYtW4tNjlh
> HMWMLxDbq9uhEJRKlq4diaLScpHbXAuJygCH3cz3Ou/0LDxIoixqaWrhoCmKgxEX
> yRC34vxl/M66DfzPCpS2r4XDYDGoIIax18gsilCDeErsfF/BL6x+9EzeIaIaNf1I
> uxPfzLkI2y7hjW7AwruaUCDZuT7YpMhM5zrby3b+bN4TKy2id6L8oreqMZ4UJ2OE
> uwiSBFelTvmvLRDqX1DViFTwK0qCaXnQDcSdPQk7J4zBEdOBCJstoKvGyk0sDVez
> KEJ6NH7rxgkJwVz51UloJW2Kxl2/gpRRUUqCD1v01tF1Ewv0VS2MEpINKvUK7DBv
> hXU8BE5MUMzB2ieT0DSw0XoffaMWYx1pJNxmhIU8m63ndgDw7ZfOgw=3D=3D
>
>
>
>
> --
> Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev=
-f1462173.html
>
>