148239127 [VE-49][00493830]Devices validating Quovadis CRL fail to decode with boring SSL

customer tries to register device to EMM provider (CORE) who links to a CA validated with Quovadis and points to a CRL hosted there.

CRL validation fails with any version of device

24 14:15:19.878 21192 21393 D CrlUtils: extractCRLs returns list of 1
01-24 14:15:19.880 21192 21393 D CrlUtils: CRL file not found MI_CRL_FILE
01-24 14:15:19.881 21192 21393 D CrlUtils: Retrieving CRL from http://crl.quovadisglobal.com/qvsslg3.crl
01-24 14:15:19.883 21192 21393 D CrlUtils: downloadCrlOverHttp: uri = http://crl.quovadisglobal.com/qvsslg3.crl
01-24 14:15:19.884 21192 21393 D CrlUtils: downloadCrlOverHttp: opened connection
01-24 14:15:19.917 21192 21393 D CrlUtils: downloadCrlOverHttp: trying to connect
01-24 14:15:20.003 21192 21393 D CrlUtils: Downloaded encoded CRL length=275211
01-24 14:15:20.015 21192 21393 W CrlUtils: Unable to parse CRL, reason: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: Error parsing PKCS#7 CRL data
01-24 14:15:20.017 21192 21393 E CrlUtils: Unable to process CRL URI: http://crl.quovadisglobal.com/qvsslg3.crl
01-24 14:15:20.018 21192 21393 W CrlUtils: Not able to retrieve CRL.
bug report attached (from xiaomi device MI8 pro Android 9)
Same error happens on Android 10 devices as well

testcase :
-> download M@W from public play store
-> enter URL for EMM registration

smartmobile4u.valeo.com

-> press next
-> error message "there was an error validating the certificate, please contact the admin"

-> in the bugreport logs we see that the error happens at boringssl level.
[CRLS (2).zip](https://github.com/google/conscrypt/files/4179596/CRLS.2.zip)
[dumpstate (1).zip](https://github.com/google/conscrypt/files/4179597/dumpstate.1.zip)

We have raised ticket with Boring SSL and below is the update:

That error suggests Conscrypt is trying to parse the input as a PKCS#7 blob, which it indeed isn't, so BoringSSL is correctly reporting an error. Try the Conscrypt folks.
https://github.com/google/conscrypt