erlang/otp — pull request #97 by Vagabond (2013-10-10 06:35:40+00:00)
Title: Various improvements to CRL handling

* If a certificate does not define the Authority Key Identifier, fall
back on the Issuer instead.
* Gracefully handle certificates with no extensions.
* Fix comparison of uniformResourceIdentifiers to not compare just the
hostname to a whole URL.

Some sample code to test this can be found here:

https://github.com/Vagabond/erl_crl_example

First, run 'make check' to run some simple tests against some generated CAs. Then you can do some CRL checking against the real world by doing

```
erl -pa ebin -run client start -s init stop
```

It will, somewhat noisily, report on the CRL status of the client certificate, and any intermediate certificate CRLs. Sometimes, like for twitter.com port 443 and myspace.com port 443, Erlang will not pass the intermediate certificates to the SSL verify_fun, so the path validation fails. I think this another bug in OTP I have not found yet, as openssl s_client shows the server providing the intermediate certificates.

Without these patches, you can't verify even the simple generated CRLs, with them you can validate *most* of the ones I've tried from the internet, the only exceptions I've found are because of the aforementioned bug.