New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provide more info when crl-check fails. #276
Conversation
@@ -157,7 +157,11 @@ def fail(reason): | |||
for line in crl.as_text().split('\n') | |||
if 'Serial Number:' in line] | |||
if cert.get_serial_number() in revoked_serials: | |||
return fail("X509 certificate is in the Revocation List (CRL)") | |||
subject = cert.get_subject() | |||
signer = subject.get_entries_by_nid(subject.nid['CN'])[0]\ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are we sure we'll always have a 'CN' containing at least 1 entry?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm, not always.
- For our fedora infra certs, yes.
- For any system that is using the
routing_policy
, yes. It requires CNs to figure things out.
But they're not strictly necessary, so this code should be modified to be more careful.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK, a73c236 should take care of that.
return fail("X509 certificate is in the Revocation List (CRL)") | ||
subject = cert.get_subject() | ||
if subject.nid.get('CN'): | ||
signer = subject.get_entries_by_nid(subject.nid['CN'])[0]\ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Still nitpicking, can the first element in the list be None
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
get_entries_by_nid calls getitem which gets things out of this 'stack' collection that communicates with the underlying openssl lib...
Cool, 👍 for me then :) |
Thanks :) |
Provide more info when crl-check fails.
No description provided.