Misjudgment of CRL Distribution Points extension
Open
@n13l is already working on this.
Since Dec 22, 2025.
backlog fix
branch: master
triaged: feature
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
RFC5280 describes this extension as follows:
When a conforming CA includes a cRLDistributionPoints extension in a certificate, it MUST include at least one DistributionPoint that points to a CRL that covers the certificate for all reasons.
I provided a test case that included a CRL distribution point extension, but the extension value was empty, which does not comply with RFC5280.
I used the this certificate to conduct a format conversion experiment.Golang throws error for certificate: invalid CRL distribution points, but openssl incorrectly conversion successful.
cert.zip
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.