[stunnel-users] CRL checking

[Fritz Gschwendner]

Hello,

I noticed a change in functionality of CRL checking in server mode
somewhere between stunnel version 5.2.00 and 5.31.00.

We have multiple services listening for incoming connections and a
global option CRLfile = crls.pem, with crls.pem containing a few CRLs
but not one for every possible client certificate, and client
certificates not all having a CRL distribution point configured.

This worked with the old version in the sense that all clients could
connect. I don't know If CRL checking really worked, they are all empty
and I can't test.

With the new version client certificates with no CRL and no CRL
distribution point configured got rejected with errors "CERT:
Pre-verification error: unable to get certificate CRL" and "SSL_accept:
14089086: error:14089086:SSL
routines:ssl3_get_client_certificate:certificate verify failed"

If I remove the global entry for CRLfile with the new version, all
clients can connect again. I guess I could enter the CRLfile option on
service level, but it could be that some client certificates connecting
to a specific service have a CRL and some don't.

My questions:

Is this intended behaviour? I find it logical to check the CRL of a
client certificate, if there is one in the CRLfile, if there isn't, to
not check.

Does a CRL distribution point configured in a client certificate play
any role?

[Michal Trojnara]

Post by Fritz Gschwendner
Is this intended behaviour? I find it logical to check the CRL of
a client certificate, if there is one in the CRLfile, if there
isn't, to not check.

Yes, this is the intended behaviour. For many years stunnel used its
own (quite ugly) CRL checking code, which ignored missing CRLs. Since
stunnel 5.24 I switched to the more strict built-in OpenSSL CRL
verification. The new functionality, if enabled, requires a valid CRL
for a CA before a certificate signed by this CA can be accepted. The
underlying concept is called "fail-secure" or "fail-closed".

Post by Fritz Gschwendner
Does a CRL distribution point configured in a client certificate
play any role?

If by the "CRL distribution point" you mean Indirect CRL (as defined
in RFC 3280, section 5), then they are currently ignored by stunnel.
The support is on my TODO list: https://www.stunnel.org/sdf_todo.html

Best regards,
Mike