tree 968f1a2668ba9bb6735b2574e509c3de4de44f94
parent 52da7ee9e03f9a9687ba021c8350404c1d6a964c
author Hanno Becker <hanno.becker@arm.com> 1541150394 +0000
committer Hanno Becker <hanno.becker@arm.com> 1541510320 +0000

Don't perform binary comparison of CRL issuer and CA subject

Previously, when checking whether a CRT was revoked through
one of the configured CRLs, the library would only consider
those CRLs whose `issuer` field binary-matches the `subject`
field of the CA that has issued the CRT in question. If those
fields were not binary equivalent, the corresponding CRL was
discarded.

This is not in line with RFC 5280, which demands that the
comparison should be format- and case-insensitive. For example:

- If the same string is once encoded as a `PrintableString` and
  another time as a `UTF8String`, they should compare equal.
- If two strings differ only in their choice of upper and lower case
  letters, they should compare equal.

This commit fixes this by using the dedicated x509_name_cmp()
function to compare the CRL issuer with the CA subject.

Fixes #1784.