commit a4e86141f1451e8097f85a823a4426e1c1cfdf7c
author Raoul Strackx <raoul.strackx@fortanix.com> Mon Jun 15 17:03:13 2020 +0200
committer Raoul Strackx <raoul.strackx@fortanix.com> Mon Aug 17 09:05:03 2020 +0200
tree b090d395aa8be2d56cb6282fefeb76607615201d
parent c60c30eb68dd70c71f902f55eb0db69b466e7503

Always revoke certificate on CRL

RFC5280 does not state that the `revocationDate` should be checked.

In addition, when no time source is available (i.e., when MBEDTLS_HAVE_TIME_DATE is not defined), `mbedtls_x509_time_is_past` always returns 0. This results in the CRL not being checked at all.

https://tools.ietf.org/html/rfc5280
Signed-off-by: Raoul Strackx <raoul.strackx@fortanix.com>

tests/data_files/test-ca.server1.future-crl.db

diff --git a/tests/data_files/test-ca.server1.future-crl.db b/tests/data_files/test-ca.server1.future-crl.db
new file mode 100644
index 0000000..763aa12
--- /dev/null
+++ b/tests/data_files/test-ca.server1.future-crl.db
@@ -0,0 +1,2 @@
+R	210212144406Z	290101124407Z	01	unknown	/C=NL/O=PolarSSL/CN=PolarSSL Server 1
+R	210212144400Z	290101124407Z	03	unknown	/C=NL/O=PolarSSL/CN=PolarSSL Test CA