Update soon to be expired crl #2417

RonEld · 2019-02-06T16:52:47Z

Description

Update crl.pem, as it will expire on November 25 2019.
Resolves #2357.

Status

READY

Requires Backporting

Yes

As this crl will be expired on the LTS branch, which will still be supported on November 25 2019, need to backport as well.

Todos

Tests
Documentation
Changelog updated
Backported

mpg

LGTM

RonEld · 2019-02-07T09:13:11Z

@mpg Thank you for your review!

I have just noticed I have missed adding crl.pem as a dependency in the Makefile.

Backported to 2.7 and 2.16 in #2418 and #2419

mpg

Thanks for catching the server1_all issue. Still looks good to me.

hanno-becker

@RonEld Have you checked other test CRLs for the expiration time?

RonEld · 2019-02-10T09:54:21Z

@hanno-arm Yes. All the other CRLs we have, the soonest year they expire is 2024.

We have other CRLs that expired at 2011, so since we didn't get any errors sine, they are probably not used in our tests, and we require some house cleaning for certificates and crls not used in tests.

mpg · 2019-02-11T08:59:06Z

Or perhaps the expired CRLs are used in tests that actually need the CRL to be expired?

RonEld · 2019-02-11T09:09:31Z

perhaps.
Anyway, when I run:
faketime -f '+2y' make test , the tests pass. ( 3 years ahead I get failures.

I have noticed that: data_files/test-ca.crt is valid until:

Not After : Feb 12 14:44:00 2021 GMT

and that data_files/server3.crt is valid until:

Not After : Aug  7 09:17:03 2023 GMT

I haven't checked other certificates. Anyway, this should be handled in a different PR, and maintained regularly.

hanno-becker · 2019-02-11T09:11:23Z

@RonEld I'd prefer those CRTs to be regenerated (and their build-instructions to be rewritten) so that they don't expire in the next 3 years. Now you/we are into the issue and it's easy to fix along the way, while waiting for another report to come up in a year's time or so and triaging and fixing it again will be more work.

mpg · 2019-02-11T09:15:11Z

In addition to what Hanno wrote, our LTS branches are supported for 3 years, so I think it would make sense for us to always ensure faketime -f '+3y' make test pass when we release a new LTS (and released one very recently, so I think we should have it pass now).

RonEld · 2019-02-11T10:29:34Z

@hanno-arm @mpg I agree that we should have a test that will ensure faketime -f '+3y' make test will pass. However, I disagree that this should be handled in this PR, as it is an entirely different task, as I think we should align all our certificates and crls to be expired on the same time, for simplicity

mpg · 2019-02-11T11:19:22Z

@RonEld I'm not sure this is an entirely different task - this PR is about making tests pass in 1 year, so just changing the numeric value from 1 to 3 hardly changes the nature of the task IMO. (The larger work you suggest in your email would indeed be a pretty different task.)

However, if you really to handle the two remaining certs necessary to pass in 3 years in this PR, I'll still approve this PR as it stands in the interest of unblocking it, as it already brings a valuable improvement that I don't want to block by requesting more of the same.

RonEld · 2019-02-11T11:45:25Z

I am working on making the tests pass in three years. however htis is more than just changing two certificates

mpg · 2019-02-11T11:49:01Z

@RonEld Why is that more than just changing the two certificates you mentioned in this earlier message? How much more?

I based my previous comment on the assumption that it would be just changing two certs, so if it's much more that than I could change my mind.

RonEld · 2019-02-11T11:53:25Z

The task for making it pass in three years include:

As you can see in the list I stated in my email, you will see many certificates that expire in three years. ( I listed the main server1.crt and test-ca.crt but all their derivatives as well). THis is not a big issue though.
Changing the Makefile in data_files to generate update certificates. Not a big issue.
Modifying the .data file in the x509parse test suite, to have the correc tinformation. This is not difficult, only takes time.

As mentioned, I am currently working on this, probably be ready by end of day

RonEld · 2019-02-12T13:13:56Z

@hanno-arm @mpg I have updated the certificates and corresponding test data files to make our tests pass 3 years ahead.
I still think this is a patch, as it should be handled in a more maintained way though.

I ran the following tests to verify:

faketime -f '+3y' make test
faketime -f '+3y' tests/ssl-opts.sh
faketime -f '+3y' programs/ssl/ssl_server2 and faketime -f '+3y' programs/ssl/ssl_client2

A few notes:

server2-badsign.crt was generated manually, using a debugger to corrupt the signature, so no Makefile entry done for that.
enco-ca-prstr.pem was generated through mbedtls_cert_write program, since openssl didn't generate the CN in printablestring. Our certificate write writes in UTF8, so manually modified this. Therefore no Makefile entry for that as well.
I am not sure what is the purpose of test-ca_uppercase.crt, as the content of original file was not in uppercase. I generated the file, as original CN.

Please review

RonEld · 2019-02-17T10:24:57Z

Note: I think it's worth fixing #822 as part of this PR

RonEld · 2019-04-08T17:20:07Z

@k-stachowiak @AndrzejKurek I amended the commit "Update certificates to expire in 2029 " to fix CI failure.
It was only removing of an extra ; character in certs.c line 203. This caused a failure in ARMCC5:

"certs.c", line 205: Error:  #381-D: extra ";" ignored
  const char mbedtls_test_srv_crt_rsa[]     =  
EST_SRV_CRT_RSA_SHA256;
                                                                      ^
certs.c: 0 warnings, 1 error
Makefile:164: recipe for target 'certs.o' failed
make[1]: *** [certs.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [lib] Error 2
Makefile:18: recipe for target 'lib' failed
^^^^build_armcc: build: ARM Compiler 5, make: command make CC=/usr/local/ARM_Compiler_5.06u3/bin//armcc AR=/usr/local/ARM_Compiler_5.06u3/bin//armar WARNING_CFLAGS=--strict --c99 lib -> 2^^^^

Please review

k-stachowiak

LGTM

RonEld · 2019-05-27T11:51:33Z

This PR and its backports have been fully reviewed and approved. Removing the "needs backports" label

cc @Patater

bmwiedemann · 2019-06-21T19:41:54Z

Hi, I'm wondering what is missing here for this to get merged? The 2019-11-25 expiry of the crl is not that far away.

bmwiedemann · 2019-07-09T13:45:56Z

collides with

commit 53756b32282d0b36a6900cf2459250a328ae6214
Author: Hanno Becker <[email protected]>
Date:   Mon Jun 3 14:14:38 2019 +0100

    Add MD[245] test CRTs to tree

Update crl.pem, as it will expire on November 25 2019. Resolves Mbed-TLS#2357.

Update certificates that expire on 2021, to prolong their validity, to make tests pass three years ahead.

RonEld · 2019-07-10T13:48:52Z

@k-stachowiak @AndrzejKurek I have rebased to resolve conflicts
During rebasing, I found new certificates that need to be updated, and other certificates that fail with faketime -f '+3y' since this PR was raised.
Please review

Add support for `MBEDTLS_SHA_224` and `MBEDTLS_SHA_384` in `cert_write`, to support generating such certificates in `tests/data_files/Makefile`.

RonEld · 2019-07-31T08:21:35Z

This PR is fully reviewed, so removing the "needs backports" label
cc @Patater

RonEld added bug mbed TLS team needs-review Every commit must be reviewed by at least two team members, component-x509 labels Feb 6, 2019

RonEld requested review from mpg and hanno-becker February 6, 2019 16:52

RonEld mentioned this pull request Feb 6, 2019

Tests fail in 2019-11-25 #2357

Closed

mpg added the needs-backports Backports are missing or are pending review and approval. label Feb 7, 2019

mpg previously approved these changes Feb 7, 2019

View reviewed changes

RonEld mentioned this pull request Feb 7, 2019

Backport 2.7: Update soon to be expired crl #2418

Merged

RonEld dismissed mpg’s stale review via 42bfcb5 February 7, 2019 09:08

RonEld mentioned this pull request Feb 7, 2019

Backport 2.16: Update soon to be expired crl #2419

Merged

mpg previously approved these changes Feb 7, 2019

View reviewed changes

hanno-becker reviewed Feb 8, 2019

View reviewed changes

RonEld dismissed mpg’s stale review via 4ef99bf February 12, 2019 13:07

RonEld mentioned this pull request Feb 13, 2019

Backport 2.7: update test RSA certificate to use SHA-256 instead of SHA-1 #2435

Merged

RonEld added the needs-work label Feb 17, 2019

RonEld force-pushed the 2734 branch from f201137 to 31674e8 Compare April 8, 2019 17:16

k-stachowiak previously approved these changes Apr 23, 2019

View reviewed changes

AndrzejKurek previously approved these changes Apr 27, 2019

View reviewed changes

RonEld removed the needs-review Every commit must be reviewed by at least two team members, label Apr 28, 2019

RonEld removed the needs-backports Backports are missing or are pending review and approval. label May 27, 2019

Ron Eldor added 2 commits July 9, 2019 16:48

Update soon to be expired crl

b7c9626

Update crl.pem, as it will expire on November 25 2019. Resolves Mbed-TLS#2357.

Update certificates to expire in 2029

9eeb861

Update certificates that expire on 2021, to prolong their validity, to make tests pass three years ahead.

RonEld dismissed stale reviews from AndrzejKurek and k-stachowiak via 2561a0c July 10, 2019 13:47

RonEld force-pushed the 2734 branch from 31674e8 to 2561a0c Compare July 10, 2019 13:47

RonEld added the needs-review Every commit must be reviewed by at least two team members, label Jul 10, 2019

Add support for all SHA modes in cert_write

991a05b

Add support for `MBEDTLS_SHA_224` and `MBEDTLS_SHA_384` in `cert_write`, to support generating such certificates in `tests/data_files/Makefile`.

RonEld force-pushed the 2734 branch from 2561a0c to 991a05b Compare July 14, 2019 06:18

AndrzejKurek approved these changes Jul 15, 2019

View reviewed changes

k-stachowiak approved these changes Jul 30, 2019

View reviewed changes

RonEld removed the needs-review Every commit must be reviewed by at least two team members, label Jul 31, 2019

Patater added the approved Design and code approved - may be waiting for CI or backports label Jul 31, 2019

gilles-peskine-arm merged commit 01655da into Mbed-TLS:development Aug 3, 2019

gilles-peskine-arm mentioned this pull request Aug 3, 2019

Changelog entry for test certificates update #2773

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update soon to be expired crl #2417

Update soon to be expired crl #2417

RonEld commented Feb 6, 2019

mpg left a comment

RonEld commented Feb 7, 2019

mpg left a comment

hanno-becker left a comment

RonEld commented Feb 10, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

hanno-becker commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019 •

edited

Loading

RonEld commented Feb 12, 2019

RonEld commented Feb 17, 2019

RonEld commented Apr 8, 2019

k-stachowiak left a comment

RonEld commented May 27, 2019

bmwiedemann commented Jun 21, 2019

bmwiedemann commented Jul 9, 2019

RonEld commented Jul 10, 2019

RonEld commented Jul 31, 2019

Update soon to be expired crl #2417

Update soon to be expired crl #2417

Conversation

RonEld commented Feb 6, 2019

Description

Status

Requires Backporting

Todos

mpg left a comment

Choose a reason for hiding this comment

RonEld commented Feb 7, 2019

mpg left a comment

Choose a reason for hiding this comment

hanno-becker left a comment

Choose a reason for hiding this comment

RonEld commented Feb 10, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

hanno-becker commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019

mpg commented Feb 11, 2019

RonEld commented Feb 11, 2019 • edited Loading

RonEld commented Feb 12, 2019

RonEld commented Feb 17, 2019

RonEld commented Apr 8, 2019

k-stachowiak left a comment

Choose a reason for hiding this comment

RonEld commented May 27, 2019

bmwiedemann commented Jun 21, 2019

bmwiedemann commented Jul 9, 2019

RonEld commented Jul 10, 2019

RonEld commented Jul 31, 2019

RonEld commented Feb 11, 2019 •

edited

Loading