Certificate revocation support is almost complete.

1 files changed, 192 insertions, 0 deletions

diff --git a/tests/test20.pem b/tests/test20.pem
new file mode 100644
index 0000000000..957832d1e9
--- /dev/null
+++ b/tests/test20.pem
@@ -0,0 +1,192 @@
+[ The intermediate certificate has been revoked ]
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 40 (0x28)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=U.S. Government, OU=Dod, OU=Testing, CN=CA1-CP.06.01
+        Validity
+            Not Before: Jan  1 12:01:00 1998 GMT
+            Not After : Jan  1 12:01:00 2048 GMT
+        Subject: C=US, O=U.S. Government, OU=DoD, OU=Testing, CN=User1-CP.06.01
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:e8:7b:95:4c:0c:45:eb:7b:b7:f0:01:23:a9:a8:
+                    db:b0:ac:9d:1c:d0:eb:85:f1:ed:fd:5d:ab:1a:c9:
+                    36:eb:92:46:c9:55:4a:16:96:9f:08:86:1e:37:3e:
+                    e7:f4:d2:ed:4a:df:8f:d5:4e:d1:db:1e:04:2c:cf:
+                    b3:26:05:a0:85:f5:ab:b4:39:ce:50:2b:c3:2d:b8:
+                    aa:95:d3:18:c9:a5:a4:41:81:cb:38:bb:8e:45:ce:
+                    f3:0e:7e:c2:a8:77:fb:c4:45:ad:04:33:af:bd:73:
+                    2e:d0:15:57:fa:8f:53:29:5e:b8:5f:0c:f2:3c:e4:
+                    c1:f3:ef:6b:0b:a7:9b:07:4b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Certificate Policies: 
+                Policy: 2.16.840.1.101.3.1.48.1
+
+            X509v3 Subject Key Identifier: 
+                6B:20:B4:3C:F5:3D:CF:2B
+            X509v3 Authority Key Identifier: 
+                keyid:08:80:26:97:3E:BE:09:CD
+
+    Signature Algorithm: sha1WithRSAEncryption
+        3f:3e:db:52:f6:84:57:b3:32:8e:17:bc:2c:93:bf:b2:88:fc:
+        e1:7e:f5:ae:f5:4f:b4:13:eb:85:88:d6:4c:9e:a9:eb:d1:82:
+        7c:94:72:86:8d:ef:01:42:2d:f1:11:5a:97:51:85:6f:bd:9c:
+        e3:90:d0:1a:47:15:cc:b2:c9:c3:c7:03:3f:76:a3:b5:66:9c:
+        e4:76:7d:74:d3:c9:91:6f:8a:87:5d:a5:f6:0a:a3:9f:4e:b5:
+        5c:08:d0:e1:79:db:6f:04:03:60:2b:97:86:0b:8f:13:db:f7:
+        93:30:db:8a:6c:15:c0:81:0e:07:fe:12:01:15:f7:ef:2e:d3:
+        51:69
+-----BEGIN CERTIFICATE-----
+MIIChjCCAe+gAwIBAgIBKDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEY
+MBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb2QxEDAOBgNVBAsT
+B1Rlc3RpbmcxFTATBgNVBAMTDENBMS1DUC4wNi4wMTAeFw05ODAxMDExMjAxMDBa
+Fw00ODAxMDExMjAxMDBaMGAxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdv
+dmVybm1lbnQxDDAKBgNVBAsTA0RvRDEQMA4GA1UECxMHVGVzdGluZzEXMBUGA1UE
+AxMOVXNlcjEtQ1AuMDYuMDEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh7
+lUwMRet7t/ABI6mo27CsnRzQ64Xx7f1dqxrJNuuSRslVShaWnwiGHjc+5/TS7Urf
+j9VO0dseBCzPsyYFoIX1q7Q5zlArwy24qpXTGMmlpEGByzi7jkXO8w5+wqh3+8RF
+rQQzr71zLtAVV/qPUyleuF8M8jzkwfPvawunmwdLAgMBAAGjUjBQMA4GA1UdDwEB
+/wQEAwIF4DAWBgNVHSAEDzANMAsGCWCGSAFlAwEwATARBgNVHQ4ECgQIayC0PPU9
+zyswEwYDVR0jBAwwCoAICIAmlz6+Cc0wDQYJKoZIhvcNAQEFBQADgYEAPz7bUvaE
+V7Myjhe8LJO/soj84X71rvVPtBPrhYjWTJ6p69GCfJRyho3vAUIt8RFal1GFb72c
+45DQGkcVzLLJw8cDP3ajtWac5HZ9dNPJkW+Kh12l9gqjn061XAjQ4XnbbwQDYCuX
+hguPE9v3kzDbimwVwIEOB/4SARX37y7TUWk=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 39 (0x27)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=U.S. Government, OU=DoD, OU=Testing, CN=Trust Anchor
+        Validity
+            Not Before: Jan  1 12:01:00 1998 GMT
+            Not After : Jan  1 12:01:00 2048 GMT
+        Subject: C=US, O=U.S. Government, OU=Dod, OU=Testing, CN=CA1-CP.06.01
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c8:e0:c5:d9:07:4f:01:7d:41:f1:a3:ff:f8:45:
+                    ee:c0:c7:4a:96:90:78:32:ea:76:fe:fd:76:8b:43:
+                    61:70:3d:bb:e9:6f:99:a4:84:b8:6a:0d:90:52:5f:
+                    72:90:2f:46:22:27:ca:7c:d6:d9:9d:bd:14:07:fc:
+                    b6:c5:cd:7f:f7:38:a0:53:51:f5:79:8a:66:32:f7:
+                    bf:40:d8:d1:1b:e2:8b:45:a7:a1:03:4a:c9:19:86:
+                    db:58:dd:dd:88:cd:42:02:a0:25:94:5e:13:9b:9e:
+                    69:07:27:68:c4:73:cd:5b:82:01:64:2b:92:e2:af:
+                    59:bf:b4:aa:b6:20:e3:c5:25
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Certificate Policies: 
+                Policy: 2.16.840.1.101.3.1.48.1
+
+            X509v3 Subject Key Identifier: 
+                08:80:26:97:3E:BE:09:CD
+            X509v3 Authority Key Identifier: 
+                keyid:AB:9A:EB:F9:C2:E7:54:8F
+
+    Signature Algorithm: sha1WithRSAEncryption
+        d1:9b:c8:1b:67:27:93:7d:a9:ea:ec:6a:1b:0f:01:bb:8d:0d:
+        ad:f1:ee:f6:03:64:24:be:4c:84:31:c9:5c:0e:8e:c5:4e:41:
+        5f:96:d6:66:92:e7:29:72:e8:1e:2a:92:76:d1:1d:9b:2e:5c:
+        2d:9c:37:92:08:31:9d:dc:63:b2:74:45:33:20:9a:c1:a6:2e:
+        a4:90:61:96:0a:ae:15:bb:af:06:d0:3c:ac:cb:64:73:91:f8:
+        ce:e7:4f:65:c3:9c:bd:7b:bb:5f:0e:7c:2b:ed:5c:69:21:94:
+        44:bf:80:ea:e5:c5:3e:73:14:05:dd:7e:93:e7:a3:6e:d3:bc:
+        3e:da
+-----BEGIN CERTIFICATE-----
+MIIClTCCAf6gAwIBAgIBJzANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEY
+MBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxEDAOBgNVBAsT
+B1Rlc3RpbmcxFTATBgNVBAMTDFRydXN0IEFuY2hvcjAeFw05ODAxMDExMjAxMDBa
+Fw00ODAxMDExMjAxMDBaMF4xCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdv
+dmVybm1lbnQxDDAKBgNVBAsTA0RvZDEQMA4GA1UECxMHVGVzdGluZzEVMBMGA1UE
+AxMMQ0ExLUNQLjA2LjAxMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI4MXZ
+B08BfUHxo//4Re7Ax0qWkHgy6nb+/XaLQ2FwPbvpb5mkhLhqDZBSX3KQL0YiJ8p8
+1tmdvRQH/LbFzX/3OKBTUfV5imYy979A2NEb4otFp6EDSskZhttY3d2IzUICoCWU
+XhObnmkHJ2jEc81bggFkK5Lir1m/tKq2IOPFJQIDAQABo2MwYTAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAWBgNVHSAEDzANMAsGCWCGSAFlAwEwATAR
+BgNVHQ4ECgQICIAmlz6+Cc0wEwYDVR0jBAwwCoAIq5rr+cLnVI8wDQYJKoZIhvcN
+AQEFBQADgYEA0ZvIG2cnk32p6uxqGw8Bu40NrfHu9gNkJL5MhDHJXA6OxU5BX5bW
+ZpLnKXLoHiqSdtEdmy5cLZw3kggxndxjsnRFMyCawaYupJBhlgquFbuvBtA8rMtk
+c5H4zudPZcOcvXu7Xw58K+1caSGURL+A6uXFPnMUBd1+k+ejbtO8Pto=
+-----END CERTIFICATE-----
+Certificate Revocation List (CRL):
+        Version 2 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: /C=US/O=U.S. Government/OU=Dod/OU=Testing/CN=CA1-CP.06.01
+        Last Update: Jan  1 12:01:00 1999 GMT
+        Next Update: Jan  1 12:01:00 2048 GMT
+        CRL extensions:
+            X509v3 CRL Number: 
+                1
+            X509v3 Authority Key Identifier: 
+                keyid:08:80:26:97:3E:BE:09:CD
+
+No Revoked Certificates.
+    Signature Algorithm: sha1WithRSAEncryption
+        6e:42:5e:8d:f7:35:af:3b:42:6e:d0:ba:c4:96:77:89:91:03:
+        0c:c5:b6:0b:11:6f:3a:f4:b0:86:60:a3:3e:a5:58:de:5a:c2:
+        3c:d4:90:cd:d8:e6:a9:ea:62:a0:29:ee:ee:89:e0:3f:e1:c0:
+        03:b8:4c:ed:b9:be:4a:83:7b:2b:35:ca:b9:f4:3b:0b:63:8d:
+        a0:0c:2f:a0:f6:60:9e:88:9d:83:b4:55:10:2c:54:07:20:fa:
+        00:9b:b4:e3:27:76:c0:22:d8:46:90:9f:4b:6b:43:b5:72:e1:
+        1c:40:e9:7b:e1:0b:c2:fd:f9:a5:b9:02:32:50:8e:da:ee:c9:
+        f9:37
+-----BEGIN X509 CRL-----
+MIIBSzCBtQIBATANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEYMBYGA1UE
+ChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb2QxEDAOBgNVBAsTB1Rlc3Rp
+bmcxFTATBgNVBAMTDENBMS1DUC4wNi4wMRcNOTkwMTAxMTIwMTAwWhcNNDgwMTAx
+MTIwMTAwWqAjMCEwCgYDVR0UBAMCAQEwEwYDVR0jBAwwCoAICIAmlz6+Cc0wDQYJ
+KoZIhvcNAQEFBQADgYEAbkJejfc1rztCbtC6xJZ3iZEDDMW2CxFvOvSwhmCjPqVY
+3lrCPNSQzdjmqepioCnu7ongP+HAA7hM7bm+SoN7KzXKufQ7C2ONoAwvoPZgnoid
+g7RVECxUByD6AJu04yd2wCLYRpCfS2tDtXLhHEDpe+ELwv35pbkCMlCO2u7J+Tc=
+-----END X509 CRL-----
+
+Certificate Revocation List (CRL):
+        Version 2 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: /C=US/O=U.S. Government/OU=DoD/OU=Testing/CN=Trust Anchor
+        Last Update: Jan  1 12:01:00 1999 GMT
+        Next Update: Jan  1 12:01:00 2048 GMT
+        CRL extensions:
+            X509v3 CRL Number: 
+                1
+            X509v3 Authority Key Identifier: 
+                keyid:AB:9A:EB:F9:C2:E7:54:8F
+
+Revoked Certificates:
+    Serial Number: 27
+        Revocation Date: Jan  1 12:00:00 1999 GMT
+            X509v3 CRL Reason Code: 
+                Key Compromise
+    Signature Algorithm: sha1WithRSAEncryption
+        0b:b9:6a:67:07:a3:25:15:bb:42:fc:c7:d7:5f:fb:71:87:0b:
+        de:b6:9c:80:cc:47:dc:f4:94:fe:e7:ef:c8:b9:3b:6a:14:7e:
+        f9:1b:47:6a:bc:bf:59:e0:af:45:dc:b3:9c:b8:88:38:0f:19:
+        06:28:2e:5a:d5:4f:aa:c3:72:b0:d9:fb:58:ba:1f:40:85:5a:
+        fb:f4:c3:dd:3f:a5:79:c7:b8:7b:53:70:19:0b:e3:e5:0f:9e:
+        db:04:6d:19:78:3e:80:2b:93:8d:32:94:15:f2:91:9d:6c:fb:
+        3b:b4:72:88:92:8a:8a:6d:23:b4:01:78:46:40:a9:2d:e6:cd:
+        0a:16
+-----BEGIN X509 CRL-----
+MIIBbzCB2QIBATANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEYMBYGA1UE
+ChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxEDAOBgNVBAsTB1Rlc3Rp
+bmcxFTATBgNVBAMTDFRydXN0IEFuY2hvchcNOTkwMTAxMTIwMTAwWhcNNDgwMTAx
+MTIwMTAwWjAiMCACAScXDTk5MDEwMTEyMDAwMFowDDAKBgNVHRUEAwoBAaAjMCEw
+CgYDVR0UBAMCAQEwEwYDVR0jBAwwCoAIq5rr+cLnVI8wDQYJKoZIhvcNAQEFBQAD
+gYEAC7lqZwejJRW7QvzH11/7cYcL3racgMxH3PSU/ufvyLk7ahR++RtHary/WeCv
+RdyznLiIOA8ZBiguWtVPqsNysNn7WLofQIVa+/TD3T+lece4e1NwGQvj5Q+e2wRt
+GXg+gCuTjTKUFfKRnWz7O7RyiJKKim0jtAF4RkCpLebNChY=
+-----END X509 CRL-----