Comments (4)
@catbro666 It will make more sense to let user to control the flag if we are working on a much low-level API (for example, a one-to-one wrapping of X509_STORE openssl api into Lua). But most of the functions in this library are designed to use by end user, in this case it's better to keep the API as simple as possible. Asking user had to call two API for CRL check but only one for trusted chain is inbalanced.
I do see the use case from mtls-auth plugin, but generally speaking, the case of "add a CRL but not use it verification" is far less common then "add a CRL and use it verification". So I would incline to keep it as is.
from lua-resty-openssl.
@fffonion Agree with high-level API should be easy to use and good by default. Setting this flag by default does make sense, but at least we should leave the possibility for the end user to not set it. The flag is not so easy to be unset, so what could have been done with one store now has to be done with two stores. OpenSSL doesn't provide direct wrapping API for unsetting flags on X509_STORE_CTX level, but does have X509_VERIFY_PARAM_clear_flags
. Maybe we can extend store:verify
with a clear_flags parameter to support this.
from lua-resty-openssl.
I get a more compelling reason now. There may be several independent CAs in the store and each CA can have its own CRL. If we add the crl of ca1 into the store, and the api automatically set the flag to the store. Then when we verify the client cert issued by ca2, it will fail with "unable to get certificate CRL"
from lua-resty-openssl.
In that case you shoudn't be adding the CRL of ca1 in the first place: only add what you intend to be verify upon later.
from lua-resty-openssl.
Related Issues (20)
- about the return value of store:verify HOT 2
- sign CSR with exixsring root Keys. HOT 8
- Wrong parameter in dump_jwk used HOT 1
- module 'resty.openssl.x509' not found HOT 4
- x509:get_extension("subjectKeyIdentifier"):text() is in weird format HOT 6
- Read custom X509 extension HOT 12
- API change in OpenSSL 3.x
- Makefile doesn't installs all files HOT 1
- module 'resty.openssl.include.x509' not found HOT 2
- nginx using boringssl start failed HOT 8
- Regression since release 0.8.0 HOT 10
- Dependency to git for installation of version 0.8.2-1 HOT 2
- lua-resty-openssl not work for latest nginx-1.21.X version HOT 2
- Symbol not found: sk_pop_free HOT 4
- BoringSSL not working HOT 1
- Is lua-resty-openssl-aux-module still required to run lua-resty-openssl in production? HOT 3
- Crash when signature with invalid JWK is attempted HOT 4
- Hot to get fingerprint? HOT 5
- 尝试解密微信支付AEAD_AES_256_GCM的加密文本遇到错误:cipher:final: EVP_CipherFinal_ex failed HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lua-resty-openssl.