From 5ff40610f281300bf12e1a583eb11b5efcc168a1 Mon Sep 17 00:00:00 2001
From: Jarno Elonen <elonen@iki.fi>
Date: Sat, 21 Sep 2024 21:23:10 +0300
Subject: [PATCH] Fix: intermediate CRLs were self-signed, not root-signed as
 it should

---
 hsm_secrets/x509/__init__.py | 9 ++++++++-
 run-tests.sh                 | 9 +++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hsm_secrets/x509/__init__.py b/hsm_secrets/x509/__init__.py
index a8776b0..2387df8 100644
--- a/hsm_secrets/x509/__init__.py
+++ b/hsm_secrets/x509/__init__.py
@@ -155,6 +155,13 @@ def _do_it(ses: HSMSession|None):
             issuer = scid_to_opq_def[cd.sign_by] if cd.sign_by and cd.sign_by != cd.id else None
             signer = f"signed by: '{issuer.label}'" if issuer else 'self-signed'
 
+            # Get CRL distribution points from issuer (if not self-signed)
+            crl_url_list = []
+            if issuer:
+                issuer_ca_def = find_ca_def(ctx.conf, issuer.id)
+                assert issuer_ca_def, f"CA cert ID not found: 0x{issuer.id:04x}"
+                crl_url_list = issuer_ca_def.crl_distribution_points
+
             cli_info(f"\nCreating 0x{cd.id:04x}: '{cd.label}' ({signer})")
             cli_info(indent(pretty_x509_info(x509_info), "    "))
 
@@ -184,7 +191,7 @@ def _do_it(ses: HSMSession|None):
                 builder = X509CertBuilder(ctx.conf, x509_ca.x509_info, priv_key)
                 if issuer_cert:
                     assert issuer_key
-                    id_to_cert_obj[cd.id] = builder.build_and_sign(issuer_cert, issuer_key, x509_ca.crl_distribution_points)
+                    id_to_cert_obj[cd.id] = builder.build_and_sign(issuer_cert, issuer_key, crl_url_list)
                     # NOTE: We'll assume all signed certs on HSM are CA -- fix this if storing leaf certs for some reason
                     issues = X509IntermediateCACertificateChecker(id_to_cert_obj[cd.id]).check_and_show_issues()
                     cert_issues.append((cd, issues))
diff --git a/run-tests.sh b/run-tests.sh
index b554bc2..c4dd95b 100755
--- a/run-tests.sh
+++ b/run-tests.sh
@@ -151,9 +151,18 @@ test_tls_certificates() {
     run_cmd -q x509 cert get --all | openssl x509 -text -noout
     assert_success
 
+    for CERT in cert_tls-t1-rsa3072  cert_tls-t1-ed25519_ed25519-root  cert_tls-t1-ecp384_ecp384-root; do
+        # Check that intermediate's CRL distribution point is set to root-signed one
+        local intermediate_cert=$(run_cmd -q x509 cert get $CERT | openssl x509 -in /dev/stdin -text -noout)
+        assert_success
+        echo "$intermediate_cert"
+        assert_grep "URI:http.*/root-a1-.*crl" "$intermediate_cert"
+    done
+
     for KEYTYPE in ed25519 ecp256 ecp384 rsa3072; do
         KEYBITS=$(echo $KEYTYPE | sed -E 's/[^0-9]//g')
 
+        # Generate a server (end-entity) certificate
         local output=$(run_cmd tls server-cert --out $TEMPDIR/www-example-com_$KEYTYPE.pem --common-name www.example.com --san-dns www.example.org --san-ip 192.168.0.1 --san-ip fd12:123::80 --keyfmt $KEYTYPE)
         assert_success
         echo "$output"