Skip to content

Commit 6e6b873

Browse files
authored
Fix getting CRL
OpenSSL 3.X pretty prints certificates in a slightly different way than previous versions, and this breaks the code for getting the URIs from the CRLDP extension. This commit fixes the issue by having awk search for additional possible strings to start the CRL Distribution Points output. Unless the CRLDP extension is malformed, it will begin with "Full Name", "Relative Name", "Reasons", or "CRL Issuer".
1 parent a47bc20 commit 6e6b873

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

testssl.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8947,7 +8947,7 @@ certificate_info() {
89478947
out "$indent"; pr_bold " Certificate Revocation List "
89488948
jsonID="cert_crlDistributionPoints"
89498949
# ~ get next 50 lines after pattern , strip until Signature Algorithm and retrieve URIs
8950-
crl="$(awk '/X509v3 CRL Distribution/{i=50} i&&i--' <<< "$cert_txt" | awk '/^$/,/^ [a-zA-Z0-9]+|^ Signature Algorithm:/' | awk -F'URI:' '/URI/ { print $2 }')"
8950+
crl="$(awk '/X509v3 CRL Distribution/{i=50} i&&i--' <<< "$cert_txt" | awk '/^$|^.*Name.*$|^.*Reasons.*$|^.*CRL Issuer.*$/,/^ [a-zA-Z0-9]+|^ Signature Algorithm:/' | awk -F'URI:' '/URI/ { print $2 }')"
89518951
if [[ -z "$crl" ]] ; then
89528952
fileout "${jsonID}${json_postfix}" "INFO" "--"
89538953
outln "--"

0 commit comments

Comments
 (0)