Close OCSP stapling and CRL revocation gaps

.github/configs/os-check-linux.json

@@ -139,6 +139,11 @@
 {"name": "ocsp-responder-nonblock-maxfrag", "minutes": 2.8,
  "configure": ["--enable-ocsp", "--enable-ocsp-responder", "--enable-ocspstapling",
   "CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP", "--enable-maxfragment"]},
+{"name": "ocsp-crl-nonblock-dtls", "minutes": 2.8,
+ "comment": "The only other WOLFSSL_NONBLOCK_OCSP profile has no CRL, status_request_v2 or DTLS, so the revocation retry paths those reach run nowhere else. crl=io adds the CRL fetch callback that blocking CRL lookups need.",
+ "configure": ["--enable-ocsp", "--enable-ocspstapling", "--enable-ocspstapling2",
+  "--enable-crl=io", "--enable-dtls", "--enable-dtls13", "--enable-anon",
+  "CPPFLAGS=-DWOLFSSL_NONBLOCK_OCSP"]},
 {"name": "dtls-records-span-datagrams", "minutes": 2.7,
  "configure": ["--enable-dtls", "--enable-dtls13", "--enable-dtls-frag-ch",
   "--enable-dtls-mtu", "CPPFLAGS=-DWOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS"]},

certs/crl/gencrls.sh

@@ -243,34 +243,70 @@ mv tmp extra-crls/large_crlnum2.pem
 
 # OCSP root-ca CRL (empty, no revocations)
 cp blank.index.txt demoCA/index.txt
+echo "01" > crlnumber
 
-echo "Step 31"
+echo "Step 32a OCSP root-ca CRL"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out ../ocsp/root-ca-crl.pem -keyfile ../ocsp/root-ca-key.pem -cert ../ocsp/root-ca-cert.pem
 check_result $?
 
 # metadata
-echo "Step 32"
+echo "Step 32a OCSP root-ca CRL metadata"
 openssl crl -in ../ocsp/root-ca-crl.pem -text > tmp
 check_result $?
 mv tmp ../ocsp/root-ca-crl.pem
 
 # OCSP root-ca CRL revoking intermediate1
 cp blank.index.txt demoCA/index.txt
+echo "01" > crlnumber
 
-echo "Step 32 OCSP root-ca CRL revoking intermediate1"
+echo "Step 32b OCSP root-ca CRL revoking intermediate1"
 openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../ocsp/intermediate1-ca-cert.pem -keyfile ../ocsp/root-ca-key.pem -cert ../ocsp/root-ca-cert.pem
 check_result $?
 
-echo "Step 32 OCSP root-ca CRL revoking intermediate1, gencrl"
+echo "Step 32b OCSP root-ca CRL revoking intermediate1, gencrl"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out ../ocsp/root-ca-crl-revoked.pem -keyfile ../ocsp/root-ca-key.pem -cert ../ocsp/root-ca-cert.pem
 check_result $?
 
 # metadata
-echo "Step 32 OCSP root-ca CRL revoking intermediate1, metadata"
+echo "Step 32b OCSP root-ca CRL revoking intermediate1, metadata"
 openssl crl -in ../ocsp/root-ca-crl-revoked.pem -text > tmp
 check_result $?
 mv tmp ../ocsp/root-ca-crl-revoked.pem
 
+# OCSP intermediate1-ca CRL (empty, no revocations)
+cp blank.index.txt demoCA/index.txt
+echo "01" > crlnumber
+
+echo "Step 32c OCSP intermediate1-ca CRL"
+openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out ../ocsp/intermediate1-ca-crl.pem -keyfile ../ocsp/intermediate1-ca-key.pem -cert ../ocsp/intermediate1-ca-cert.pem
+check_result $?
+
+# metadata
+echo "Step 32c OCSP intermediate1-ca CRL metadata"
+openssl crl -in ../ocsp/intermediate1-ca-crl.pem -text > tmp
+check_result $?
+mv tmp ../ocsp/intermediate1-ca-crl.pem
+
+# OCSP intermediate1-ca CRL revoking server1
+cp blank.index.txt demoCA/index.txt
+echo "01" > crlnumber
+
+echo "Step 32d OCSP intermediate1-ca CRL revoking server1"
+openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../ocsp/server1-cert.pem -keyfile ../ocsp/intermediate1-ca-key.pem -cert ../ocsp/intermediate1-ca-cert.pem
+check_result $?
+
+echo "Step 32d OCSP intermediate1-ca CRL revoking server1, gencrl"
+openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out ../ocsp/intermediate1-ca-crl-revoked.pem -keyfile ../ocsp/intermediate1-ca-key.pem -cert ../ocsp/intermediate1-ca-cert.pem
+check_result $?
+
+# metadata
+echo "Step 32d OCSP intermediate1-ca CRL revoking server1, metadata"
+openssl crl -in ../ocsp/intermediate1-ca-crl-revoked.pem -text > tmp
+check_result $?
+mv tmp ../ocsp/intermediate1-ca-crl-revoked.pem
+
+cp blank.index.txt demoCA/index.txt
+
 echo "Step 33 larger CRL number( 57 octets )"
 python3 -c "print('4' * 114)" > crlnumber # 0x41 * 57 = 114 hex chars crlnumber
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out extra-crls/crlnum_57oct.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem

certs/ocsp/include.am

@@ -11,6 +11,8 @@ EXTRA_DIST += \
         certs/ocsp/index-intermediate2-ca-issued-certs.txt.attr \
         certs/ocsp/index-intermediate3-ca-issued-certs.txt \
         certs/ocsp/index-intermediate3-ca-issued-certs.txt.attr \
+        certs/ocsp/index-intermediate4-ca-issued-certs.txt \
+        certs/ocsp/index-intermediate4-ca-issued-certs.txt.attr \
         certs/ocsp/openssl.cnf \
         certs/ocsp/renewcerts-for-test.sh \
         certs/ocsp/intermediate1-ca-key.pem \
@@ -25,6 +27,10 @@ EXTRA_DIST += \
         certs/ocsp/intermediate3-ca-key.der \
         certs/ocsp/intermediate3-ca-cert.pem \
         certs/ocsp/intermediate3-ca-cert.der \
+        certs/ocsp/intermediate4-ca-key.pem \
+        certs/ocsp/intermediate4-ca-key.der \
+        certs/ocsp/intermediate4-ca-cert.pem \
+        certs/ocsp/intermediate4-ca-cert.der \
         certs/ocsp/ocsp-responder-key.pem \
         certs/ocsp/ocsp-responder-key.der \
         certs/ocsp/ocsp-responder-cert.pem \
@@ -38,6 +44,7 @@ EXTRA_DIST += \
         certs/ocsp/server1-cert.pem \
         certs/ocsp/server1-cert.der \
         certs/ocsp/server1-chain-noroot.pem \
+        certs/ocsp/server1-leaf.pem \
         certs/ocsp/server2-key.pem \
         certs/ocsp/server2-key.der \
         certs/ocsp/server2-cert.pem \
@@ -54,12 +61,19 @@ EXTRA_DIST += \
         certs/ocsp/server5-key.der \
         certs/ocsp/server5-cert.pem \
         certs/ocsp/server5-cert.der \
+        certs/ocsp/server6-key.pem \
+        certs/ocsp/server6-key.der \
+        certs/ocsp/server6-cert.pem \
+        certs/ocsp/server6-cert.der \
+        certs/ocsp/server6-chain-noroot.pem \
         certs/ocsp/root-ca-key.pem \
         certs/ocsp/root-ca-key.der \
         certs/ocsp/root-ca-cert.pem \
         certs/ocsp/root-ca-cert.der \
         certs/ocsp/root-ca-crl.pem \
         certs/ocsp/root-ca-crl-revoked.pem \
+        certs/ocsp/intermediate1-ca-crl.pem \
+        certs/ocsp/intermediate1-ca-crl-revoked.pem \
         certs/ocsp/imposter-root-ca-key.pem \
         certs/ocsp/imposter-root-ca-key.der \
         certs/ocsp/imposter-root-ca-cert.pem \
@@ -68,4 +82,5 @@ EXTRA_DIST += \
         certs/ocsp/test-response-rsapss.der \
         certs/ocsp/test-response-nointern.der \
         certs/ocsp/test-multi-response.der \
-        certs/ocsp/test-leaf-response.der
+        certs/ocsp/test-leaf-response.der \
+        certs/ocsp/test-server6-response.der

certs/ocsp/index-intermediate4-ca-issued-certs.txt

@@ -0,0 +1 @@
+V	290620175629Z		0C	unknown	/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=www6.wolfssl.com/emailAddress=facts@wolfssl.com

certs/ocsp/index-intermediate4-ca-issued-certs.txt.attr

@@ -0,0 +1 @@
+unique_subject = no

certs/ocsp/intermediate1-ca-crl-revoked.pem

@@ -0,0 +1,43 @@
+Certificate Revocation List (CRL):
+    Version 2 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+    Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Engineering, CN=wolfSSL intermediate CA 1, emailAddress=facts@wolfssl.com
+    Last Update: Sep 18 13:51:09 2026 GMT
+    Next Update: Jun 14 13:51:09 2029 GMT
+    CRL extensions:
+        X509v3 CRL Number: 
+            1
+Revoked Certificates:
+    Serial Number: 05
+        Revocation Date: Sep 18 13:51:09 2026 GMT
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        ad:01:b6:b5:2f:bd:f5:23:9a:44:4f:09:4c:37:cc:39:50:c9:
+        74:21:66:d9:70:b4:77:40:5c:37:50:4f:18:ff:8b:4e:40:41:
+        36:c7:31:ae:59:77:fe:17:24:5f:9f:1d:6e:c9:f3:40:f0:cf:
+        6c:f3:3b:f4:31:2f:ce:c2:a9:8e:d5:51:f0:05:21:78:96:6d:
+        24:50:45:b3:98:ec:c6:e9:e6:55:80:1b:ef:6d:e9:59:70:0e:
+        52:65:31:2b:77:11:79:62:5c:e7:67:4b:9e:7d:cf:66:3c:e5:
+        57:c3:43:81:cb:3f:ab:70:63:90:e6:4a:a6:6e:f0:89:df:1c:
+        e8:0c:d5:7a:80:72:bf:e6:f2:ec:10:57:a0:f5:3a:4a:5a:d7:
+        fb:bd:97:3e:5c:e3:f2:38:ad:98:ec:6f:8f:c5:f5:7c:6a:09:
+        8e:c1:c9:61:23:3f:a7:df:df:97:69:8d:fd:12:d1:22:03:ee:
+        b7:e9:70:aa:cb:00:b6:f3:c3:a8:c0:e5:0e:fa:38:88:d0:7d:
+        95:75:1a:1b:52:bc:c9:70:81:6d:42:84:19:64:e6:eb:44:8d:
+        e2:47:9c:81:35:63:38:b2:45:05:87:26:99:24:f3:4c:c3:b0:
+        71:44:ae:a1:61:46:7f:4e:ff:7c:a5:29:2d:e6:6d:68:fd:74:
+        f8:83:b5:9a
+-----BEGIN X509 CRL-----
+MIICEjCB+wIBATANBgkqhkiG9w0BAQsFADCBojELMAkGA1UEBhMCVVMxEzARBgNV
+BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
+U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy
+bWVkaWF0ZSBDQSAxMSAwHgYJKoZIhvcNAQkBFhFmYWN0c0B3b2xmc3NsLmNvbRcN
+MjYwOTE4MTM1MTA5WhcNMjkwNjE0MTM1MTA5WjAUMBICAQUXDTI2MDkxODEzNTEw
+OVqgDjAMMAoGA1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IBAQCtAba1L731I5pE
+TwlMN8w5UMl0IWbZcLR3QFw3UE8Y/4tOQEE2xzGuWXf+FyRfnx1uyfNA8M9s8zv0
+MS/OwqmO1VHwBSF4lm0kUEWzmOzG6eZVgBvvbelZcA5SZTErdxF5YlznZ0uefc9m
+POVXw0OByz+rcGOQ5kqmbvCJ3xzoDNV6gHK/5vLsEFeg9TpKWtf7vZc+XOPyOK2Y
+7G+PxfV8agmOwclhIz+n39+XaY39EtEiA+636XCqywC288OowOUO+jiI0H2VdRob
+UrzJcIFtQoQZZObrRI3iR5yBNWM4skUFhyaZJPNMw7BxRK6hYUZ/Tv98pSkt5m1o
+/XT4g7Wa
+-----END X509 CRL-----

certs/ocsp/intermediate1-ca-crl.pem

@@ -0,0 +1,40 @@
+Certificate Revocation List (CRL):
+    Version 2 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+    Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Engineering, CN=wolfSSL intermediate CA 1, emailAddress=facts@wolfssl.com
+    Last Update: Sep 17 15:39:48 2026 GMT
+    Next Update: Jun 13 15:39:48 2029 GMT
+    CRL extensions:
+        X509v3 CRL Number: 
+            1
+No Revoked Certificates.
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        9d:c6:a8:22:97:72:98:95:de:65:7d:07:62:d4:4b:cf:ff:ea:
+        c5:88:f2:13:27:3b:ad:55:e5:1a:b4:fc:4f:21:83:32:e6:3c:
+        0c:b6:d1:5e:8c:9b:47:b4:75:d5:48:45:2b:97:db:1a:48:a8:
+        8f:36:ac:55:4d:5a:0b:2b:bc:20:af:ee:6c:a9:ef:78:b9:96:
+        53:5e:e0:7a:f7:38:a6:27:4a:bb:25:5e:73:52:12:e5:67:04:
+        01:a9:f5:95:60:a8:2e:92:e5:02:7d:b1:b9:a1:9e:c1:6f:40:
+        91:30:71:5d:59:5b:13:85:cd:3c:08:8c:af:8d:a5:ad:71:c3:
+        ca:5f:14:55:22:c4:aa:62:07:1f:56:3d:1c:6c:35:f5:4e:9d:
+        29:ba:a4:5c:4b:33:75:3b:46:f0:e7:ce:50:47:c3:ac:56:5e:
+        d7:84:50:1e:5f:d0:ca:5a:d8:a7:08:d5:25:e1:7f:41:29:d8:
+        7a:66:71:b6:f8:24:87:5c:15:15:b4:17:dd:c4:f1:68:16:e2:
+        ba:59:f1:0b:c7:e7:f2:18:94:3c:37:4a:2b:fd:2d:68:92:79:
+        14:29:f9:e0:35:07:79:ee:8c:da:24:84:d3:a3:3e:4e:7d:23:
+        95:2b:77:0b:f6:9e:2e:6f:6d:f1:a6:25:b5:7f:80:87:93:a9:
+        7d:fc:b4:1a
+-----BEGIN X509 CRL-----
+MIIB/DCB5QIBATANBgkqhkiG9w0BAQsFADCBojELMAkGA1UEBhMCVVMxEzARBgNV
+BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT
+U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy
+bWVkaWF0ZSBDQSAxMSAwHgYJKoZIhvcNAQkBFhFmYWN0c0B3b2xmc3NsLmNvbRcN
+MjYwOTE3MTUzOTQ4WhcNMjkwNjEzMTUzOTQ4WqAOMAwwCgYDVR0UBAMCAQEwDQYJ
+KoZIhvcNAQELBQADggEBAJ3GqCKXcpiV3mV9B2LUS8//6sWI8hMnO61V5Rq0/E8h
+gzLmPAy20V6Mm0e0ddVIRSuX2xpIqI82rFVNWgsrvCCv7myp73i5llNe4Hr3OKYn
+SrslXnNSEuVnBAGp9ZVgqC6S5QJ9sbmhnsFvQJEwcV1ZWxOFzTwIjK+Npa1xw8pf
+FFUixKpiBx9WPRxsNfVOnSm6pFxLM3U7RvDnzlBHw6xWXteEUB5f0Mpa2KcI1SXh
+f0Ep2Hpmcbb4JIdcFRW0F93E8WgW4rpZ8QvH5/IYlDw3Siv9LWiSeRQp+eA1B3nu
+jNokhNOjPk59I5Urdwv2ni5vbfGmJbV/gIeTqX38tBo=
+-----END X509 CRL-----