Quantcast
Channel: Public Key Infrastructure PowerShell module
Viewing all articles
Browse latest Browse all 729

Created Unassigned: CRL revocation check bug [85]

$
0
0
Hi,

I tested the certificate at https://revoked.grc.com and https://test-sspev.verisign.com:2443/test-SSPEV-revoked-verisign.html to see if they were revoked (they should be) in their CRL revocation lists like this:

byte[] crlRawData = File.ReadAllBytes(...);
X509Certificate2 cert = new X509Certificate2(File.ReadAllBytes(...));

X509CRL2 crl = new X509CRL2(crlRawData);
X509CRLEntry bla = crl.RevokedCertificates[cert.SerialNumber];

However, bla == null, so they are reported as NOT revoked.

I took a look inside X509CRL2.cs in the get_revokedcertificates() method, and it seems rawBytes contains the information in the wrong endianess.

I edited the code to be like this:
Byte[] rawBytes = new Byte[CRLEntry.SerialNumber.cbData];
Marshal.Copy(CRLEntry.SerialNumber.pbData, rawBytes, 0, rawBytes.Length);

//This is new
rawBytes = rawBytes.Reverse().ToArray();

String serialNumberStr = rawBytes.Aggregate("", (current, b) => current + b.ToString("x2"));

And now the serial number is correct and the two certificates are reported as revoked.

Viewing all articles
Browse latest Browse all 729

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>