Question

我正在开发一个xcode自动构建系统。执行一些预构建验证时，我想检查指定的证书文件是否已被撤销。我知道security verify-cert验证其他证书属性，但不验证撤销。我怎样才能检查是否失败？

我正在用Ruby编写构建系统，但我对任何语言的思想都非常开放。

我读了这个答案（Openssl - How to check if a certificate is revoked or not）但是底部的链接（Does OpenSSL automatically handle CRLs (Certificate Revocation Lists) now?）进入的材料对我的目的来说有点过于牵连（用户上传已撤销的证书是远远不够的案件）。是否有一个更简单/ ruby导向的方法来检查revokation？

提前致谢！

Answer 1

检查证书是否被撤销可能是一个复杂的过程。首先，您必须查找CDP或OCSP AIA，然后发出请求，解析响应，并检查响应是否由有权响应相关证书的CA签署。如果是CRL，则需要查看列表中是否存在您正在检查的证书的序列号。如果它是OCSP，那么您需要查看您是否收到了“良好”响应（而不是未知，已撤销或任何OCSP响应者错误，如未经授权）。此外，您可能需要验证证书是否在其有效期内，并链接到受信任的根。最后，您还应对每个中间人进行撤销检查，并根据Mozilla / Apple / Google / Microsoft维护的明确黑名单检查证书的指纹。

我不知道任何Ruby库为你自动化撤销检查过程（最终我希望将它添加到r509），但是考虑到你的更具体的用例，这里有一些未经测试的代码可以指向你正确的方向。

require 'r509'
require 'net/http'
cert = R509::Cert.load_from_file("some_iphone_cert.pem")
crl_uri = cert.crl_distribution_points.crl.uris[0]
crl = Net::HTTP.get_response(URI(crl_uri)) # you may need to follow redirects here, but let's assume you got the CRL.
# Also note that the Apple WWDRCA CRL is like 28MB so you may want to cache this damned thing. OCSP would be nicer but it's a bit trickier to validate.
parsed_crl = R509::CRL::SignedList.new(crl)
if not parsed_crl.verify(cert.public_key)
  raise StandardError, "Invalid CRL for certificate"
end
if parsed_crl.revoked?(cert.serial)
  puts 'revoked'
end

不幸的是，由于Apple WWDRCA CRL的大小（~680k条目），使用r509的当前哈希映射模型，这种检查可能会非常慢。

如果您对沿着OCSP路径感兴趣，我可以编写如何在Ruby中生成OCSP请求/解析响应。

编辑：看来iPhone开发人员证书我没有包含嵌入式OCSP AIA，因此撤销检查的唯一选择是通过上面提到的CRL分发点。

Edit2：哦，为什么不呢，让我们在Ruby中进行OCSP检查！为此，我们需要证书及其颁发证书。您不能使用WWDRCA证书，因此只需从您喜欢的网站上获取一个。我正在使用自己的网站。

require 'net/http'
require 'r509'
cert = R509::Cert.load_from_file("my_website.pem")
# get the first OCSP AIA URI. There can be more than one 
# (degenerate example!)
ocsp_uri = cert.aia.ocsp.uris[0]
issuer = R509::Cert.load_from_file("my_issuer.pem")
cert_id = OpenSSL::OCSP::CertificateId.new(cert.cert,issuer.cert)
request = OpenSSL::OCSP::Request.new
request.add_certid(cert_id)
# we're going to make a GET request per RFC 5019. You can also POST the 
# binary DER encoded version if you're more of an RFC 2560 partisan
request_uri = URI(ocsp_uri+"/"+URI.encode_www_form_component(req_pem.strip)
http_response = Net::HTTP.get_response(request_uri)
if http_response.code != "200"
  raise StandardError, "Invalid response code from OCSP responder"
end
response = OpenSSL::OCSP::Response.new(http_response.body)
if response.status != 0
  raise StandardError, "Not a successful status"
end
if response.basic[0][0].serial != cert.serial
  raise StandardError, "Not the same serial"
end
if response.basic[0][1] != 0 # 0 is good, 1 is revoked, 2 is unknown.
  raise StandardError, "Not a good status"
end
current_time = Time.now
if response.basic[0][4] > current_time or response.basic[0][5] < current_time
  raise StandardError, "The response is not within its validity window"
end
# we also need to verify that the OCSP response is signed by 
# a certificate that is allowed and chains up to a trusted root. 
# To do this you'll need to build an OpenSSL::X509::Store object 
# that contains the certificate you're checking + intermediates + root.
store = OpenSSL::X509::Store.new
store.add_cert(cert.cert)
store.add_cert(issuer.cert) #assuming issuer is a trusted root here, but in reality you'll need at least one more certificate
if response.basic.verify([],store) != true
  raise StandardError, "Certificate verification error"
end

上面的示例代码忽略了处理许多可能的边缘情况，因此它应该仅被视为起点。祝你好运！

Answer 2

保罗的例子没有使用我的本地服务器，由OpenSSL Cookbook制作，但已经使用了帖子请求

# openssl ocsp -port 9080 -index db/index -rsigner root-ocsp.crt -rkey private/root-ocsp.key -CA root-ca.crt -text
# openssl ocsp -issuer root-ca.crt -CAfile root-ca.crt -cert root-ocsp.crt -url http://127.0.0.1:9080

require 'net/http'
require 'openssl'
require 'base64'
require 'test/unit'
extend Test::Unit::Assertions

def load_cert(name)
  OpenSSL::X509::Certificate.new(File.read(name))
end

ca_file = issuer = load_cert('root-ca.crt')
cert = load_cert('root-ocsp.crt')

cid = OpenSSL::OCSP::CertificateId.new(cert, issuer)
request = OpenSSL::OCSP::Request.new.add_certid(cid)

# with get, invalid, server responding with
# Invalid request
# Responder Error: malformedrequest (1)
#
# encoded_der = Base64.encode64(request.to_der)
# request_uri = URI.parse('http://127.0.0.1/' + URI.encode_www_form_component(encoded_der.strip))
# req = Net::HTTP::Get.new(request_uri.path, 'Content-Type' => 'application/ocsp-response')
# http_resp = Net::HTTP.new(request_uri.host, '9080').request(req)

# with post, work
ocsp_uri = URI('http://127.0.0.1:9080/')
http_resp = Net::HTTP.post(ocsp_uri, request.to_der, 'Content-Type' => 'application/ocsp-response')

resp = OpenSSL::OCSP::Response.new(http_resp.body)

assert_equal resp.status, OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
assert resp.basic.is_a? OpenSSL::OCSP::BasicResponse

current_time = Time.now
resp.basic.status.each do |status_arr|
  certificate_id, status, reason, revocation_time, this_update, next_update, extensions = status_arr
  assert_equal status, 0 # 0 is good, 1 is revoked, 2 is unknown.
  assert this_update < current_time
  assert next_update.nil?
end

first_cert_id = resp.basic.status[0][0]
assert first_cert_id.cmp(cid)
assert first_cert_id.cmp_issuer(cid)
assert_equal first_cert_id.serial, cert.serial

resp.basic.responses.each do |resp|
  assert resp.is_a? OpenSSL::OCSP::SingleResponse
  assert resp.check_validity
end

store = OpenSSL::X509::Store.new
store.add_cert(cert)
store.add_cert(issuer) # assuming issuer is a trusted root here, but in reality you'll need at least one more certificate
assert resp.basic.verify([], store)

P.S。现在它请求ocsp证书的状态（如书中），想要请求服务器/最终实体状态，但首先我必须尝试使用openssl cli和here I have stumbled

P.S.S

这样做，谢谢Steffen Ullrich

# openssl ocsp -port 9080 -index db/index -rsigner subca-ocsp.crt -rkey private/subca-ocsp.key -CA sub-ca.crt -text
# cat sub-ca.crt root-ca.crt > sub-and-root.crt
# openssl ocsp -issuer sub-ca.crt -CAfile sub-and-root.crt -cert server.crt -url http://127.0.0.1:9080

require 'net/http'
require 'openssl'
require 'base64'
require 'test/unit'
extend Test::Unit::Assertions

def load_cert(name)
  OpenSSL::X509::Certificate.new(File.read(name))
end

subca = load_cert('sub-ca.crt')
root = load_cert('root-ca.crt')
cert = load_cert('server.crt')

cid = OpenSSL::OCSP::CertificateId.new(cert, subca)
request = OpenSSL::OCSP::Request.new.add_certid(cid)

# with post, work
ocsp_uri = URI('http://127.0.0.1:9080/')
http_resp = Net::HTTP.post(ocsp_uri, request.to_der, 'Content-Type' => 'application/ocsp-response')

resp = OpenSSL::OCSP::Response.new(http_resp.body)

assert_equal resp.status, OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
assert resp.basic.is_a? OpenSSL::OCSP::BasicResponse

first_cert_id = resp.basic.status[0][0]
assert first_cert_id.cmp(cid)
assert first_cert_id.cmp_issuer(cid)
assert_equal first_cert_id.serial, cert.serial

resp.basic.responses.each do |resp|
  assert resp.is_a? OpenSSL::OCSP::SingleResponse
  assert resp.check_validity
end

store = OpenSSL::X509::Store.new
store.add_cert(cert)
store.add_cert(subca)
store.add_cert(root)
assert resp.basic.verify([], store)

Answer 3

为了记录，很大程度上受到 Paul Kehrer answer 的启发（谢谢！）我写了一个小的 ruby gem 来检查证书的有效性和吊销（它在我的产品 updown.io 中使用）：{{3} }

# Gemfile
gem 'ssl-test'

这是一个例子：

valid, error, cert = SSLTest.test "https://revoked.badssl.com"
valid # => false
error # => "SSL certificate revoked: The certificate was revoked for an unknown reason (revocation date: 2019-10-07 20:30:39 UTC)"
cert # => #<OpenSSL::X509::Certificate...>

由于 1.4，它同时支持 OCSP 和 CRL。

如何以编程方式检查证书是否已被撤销？

3 个答案: