Skip to content

[Bug]: Questions about wolfssl verify #9086

Closed
Closed
[Bug]: Questions about wolfssl verify#9086
Assignees
miyazakh
Labels
bug

Description

@onepeople158
onepeople158
opened on Aug 11, 2025

Contact Details

No response

Version

I am using version 0.1.7 of the wolfssl Command Line Utility. Linked to wolfSSL version 5.7.6

Description

Hello developer, I'm not sure if wolfssl has a command for CRL revocation checks. When I perform a revocation check using openssl, openssl indicates that the certificate has been revoked, but wolfssl does not display any information related to the certificate being revoked.

command:
wolfssl verify -CAfile root_cert_1.pem -CRLfile crl_revokedCert_02.pem ca1.pem

test cases:

isRevoked.zip

Reproduction steps

No response

Relevant log output

Activity
  1. onepeople158
    added 
    bug
     on Aug 11, 2025
  2. dgarske
    assigned 
    wolfSSL-Bot
    and
    kareem-wolfssl
    on Aug 11, 2025
  3. kareem-wolfssl commented on Aug 12, 2025 
    @kareem-wolfssl
    kareem-wolfssl
    on Aug 12, 2025
    Contributor
    Hello @onepeople158 ,
    

    How are you building wolfSSL?  You will need to pass in --enable-crl to enable CRL support.
    
Please use wolfSSL 5.8.2 with wolfCLU master, we have had significant changes to both since 0.1.7/5.7.6.
  4. onepeople158 commented on Aug 26, 2025 
    @onepeople158
    onepeople158
    on Aug 26, 2025
    Author
    

    Hello @onepeople158 ,
    

    How are you building wolfSSL? You will need to pass in to enable CRL support. Please use wolfSSL 5.8.2 with wolfCLU master, we have had significant changes to both since 0.1.7/5.7.6.--enable-crl
    

    

    Hello Developers,
    

    Hello. I have installed the latest version of wolfSSL.
    

    The following is the displayed result:
    
You are using version 0.1.8 of the wolfssl Command Line Utility.
    
Linked to wolfSSL version 5.8.2
    

    I ran the command below and am not sure if wolfSSL supports CRL revocation checking:
    
wolfssl verify -CAfile root_cert_1.pem -CRLfile crl_revokedCert_02.pem ca1.pem
    

    The command output was:
    
verifying certificate file ca1.pem
    
using CA file root_cert_1.pem
    
OK
  5. holtrop commented on Aug 26, 2025 
    @holtrop
    holtrop
    on Aug 26, 2025
    Hello @onepeople158, I will take a look at this. I see your test case files in the isRevoked.zip file. Can you include the openssl verify commands you are using for comparison?
  6. onepeople158 commented on Aug 27, 2025 
    @onepeople158
    onepeople158
    on Aug 27, 2025
    Author
    

    Hello @onepeople158, I will take a look at this. I see your test case files in the isRevoked.zip file. Can you include the openssl verify commands you are using for comparison?
    

    

    openssl verify -crl_check -x509_strict -CAfile root_cert_1.pem -CRLfile crl_revokedCert_02.pem ca1.pem
    
C=CN, ST=Beijing, L=Beijing, O=My Organization, CN=My Intermediate CA
    
error 23 at 0 depth lookup: certificate revoked
    
error ca1.pem: verification failed
  7. holtrop commented on Aug 27, 2025 
    @holtrop
    holtrop
    on Aug 27, 2025
    Hello @onepeople158 . wolfssl verify does have a -crl_check flag as well.
    

    $ wolfssl verify -help
./wolfssl verify -CAfile <ca file name> [-untrusted <intermidate file>] [-crl_check] [-partial_chain] <cert to verify>

    

    If I include that flag in the wolfssl command and use the same flags as with your openssl verify command, I do also get an error from wolfssl, although the error message is different:
    

    $ wolfssl verify -crl_check -x509_strict -CAfile root_cert_1.pem -CRLfile crl_revokedCert_02.pem ca1.pem
verifying certificate file ca1.pem
using CA file root_cert_1.pem
Verification Failed
Err (3): non-blocking socket write buffer full
Error wolfcrypt/src/asn.c:26140: ASN self-signed certificate error (-275)
Error returned: -1.

    

    This is with the latest version of wolfssl from git.
  8. holtrop commented on Aug 27, 2025 
    @holtrop
    holtrop
    on Aug 27, 2025
    You are correct that wolfssl does not say that the certificate was revoked in this case. I'll check with the team to see about improving the error message.
  9. onepeople158 commented on Aug 28, 2025 
    @onepeople158
    onepeople158
    on Aug 28, 2025
    Author
    

    Hello @onepeople158 . wolfssl verify does have a -crl_check flag as well.
    

    $ wolfssl verify -help
./wolfssl verify -CAfile <ca file name> [-untrusted <intermidate file>] [-crl_check] [-partial_chain] <cert to verify>

    

    If I include that flag in the wolfssl command and use the same flags as with your openssl verify command, I do also get an error from wolfssl, although the error message is different:
    

    $ wolfssl verify -crl_check -x509_strict -CAfile root_cert_1.pem -CRLfile crl_revokedCert_02.pem ca1.pem
verifying certificate file ca1.pem
using CA file root_cert_1.pem
Verification Failed
Err (3): non-blocking socket write buffer full
Error wolfcrypt/src/asn.c:26140: ASN self-signed certificate error (-275)
Error returned: -1.

    

    This is with the latest version of wolfssl from git.
    

    

    If you use this command, it will also report an error for the correct CRL.
    

    wolfssl verify -crl_check -x509_strict -CAfile root_cert_1.pem -CRLfile right_crl.pem  ca1.pem
verifying certificate file ca1.pem
using CA file root_cert_1.pem
Verification Failed
Err (-362): CRL missing, not loaded
Error returned: -1.

openssl verify -crl_check -x509_strict -CAfile root_cert_1.pem -CRLfile right_crl.pem ca1.pem
ca1.pem: OK

    

    right_crl.zip
  10. holtrop commented on Sep 2, 2025 
    @holtrop
    holtrop
    on Sep 2, 2025
    Hello @onepeople158 , I will take a look at this as well.
    

    For comparison, can you share the commands you used to create the test certificates in the two .zip archives that you shared?
  11. onepeople158 commented on Sep 3, 2025 
    @onepeople158
    onepeople158
    on Sep 3, 2025
    Author
    

    Hello @onepeople158 , I will take a look at this as well.
    

    For comparison, can you share the commands you used to create the test certificates in the two .zip archives that you shared?
    

    

    These certificates were created using the cryptography library in Python.
  12. holtrop commented on Sep 15, 2025 
    @holtrop
    holtrop
    on Sep 15, 2025
    @onepeople158 Are you able to reproduce this by only using openssl commands to generate the test certificates/CRL?
  13. onepeople158 commented on Sep 16, 2025 
    @onepeople158
    onepeople158
    on Sep 16, 2025
    Author
    

    @onepeople158 Are you able to reproduce this by only using openssl commands to generate the test certificates/CRL?
    

    

    These are the CRL, target certificate, and root certificate I generated using the OpenSSL command line (CRL: rootCA.crl, Root Certificate: rootCA.crt, Target Certificate: target.crt).
    

    openssl_crl_check.zip
    

    command:
    

    1.Generate the root certificate private key:
openssl genrsa -out rootCA.key 2048

2.Generate the self-signed root certificate:
openssl req -new -x509 -days 3650 -key rootCA.key -out rootCA.crt

3.Generate the target certificate private key:
openssl genrsa -out target.key 2048

4.Generate the target certificate request (CSR):
openssl req -new -key target.key -out target.csr

5.Sign the target certificate with the root certificate:
openssl x509 -req -in target.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out target.crt -days 365

6.Create CRL index file and serial number file:
mkdir -p crl
touch crl/index.txt
echo 01 > crl/crlnumber

7.Revoke the target certificate (obtain the certificate serial number):
openssl x509 -in target.crt -noout -serial
openssl ca -revoke target.crt -keyfile rootCA.key -cert rootCA.crt -config openssl.cnf

8.Generate the CRL file:
openssl ca -gencrl -out rootCA.crt -keyfile rootCA.key -cert rootCA.crt -config openssl.cnf

  14. embhorn
    assigned 
    holtrop
     and unassigned 
    wolfSSL-Bot
    and
    kareem-wolfssl
    on Dec 16, 2025
  15. holtrop-wolfssl
    assigned 
    holtrop-wolfssl
     and unassigned 
    holtrop
    on Dec 17, 2025
  16. holtrop-wolfssl
    assigned 
    miyazakh
     and unassigned 
    holtrop-wolfssl
    on Dec 30, 2025
  17. miyazakh commented on Jan 9, 2026 
    @miyazakh
    miyazakh
    on Jan 9, 2026
    Contributor
    Hi @onepeople158
    

    It seems that there are multiple reasons why this does not work as expected.
    

      

    1. wolfCLU doesn't support -CRLfile option yet.
      2. 

    2. Parsing CRL fails when CRL number is large.
      3. 

    3. Error code mapping issues.
      4. 

    

    For #1, could you concatenate the CRL and the CA certificate, and then use the result as the -CAfile argument, as shown below?
    

    cat your_crl.pem >> crl_rootca.pem
cat root_cert_1.pem >> crl_rootca.pem
./wolfssl verify -CAfile crl_rootca.pem -crl_check ca1.pem

    

    For #2, I have submitted a fix as PR#968. In the meantime, could you try configuring wolfSSL with CFLAGS="-DCRL_MAX_NUM_SZ=40"?
    

    For #3, I am working on it.
  18. onepeople158 commented on Jan 9, 2026 
    @onepeople158
    onepeople158
    on Jan 9, 2026
    Author
    

    Hi @onepeople158
    

    It seems that there are multiple reasons why this does not work as expected.
    

      

    1. wolfCLU doesn't support  option yet.-CRLfile
      2. 

    2. Parsing CRL fails when CRL number is large.
      3. 

    3. Error code mapping issues.
      4. 

    

    For , could you concatenate the CRL and the CA certificate, and then use the result as the argument, as shown below?#1``-CAfile
    

    cat your_crl.pem >> crl_rootca.pem
cat root_cert_1.pem >> crl_rootca.pem
./wolfssl verify -CAfile crl_rootca.pem -crl_check ca1.pem

    

    For , I have submitted a fix as PR#968. In the meantime, could you try configuring wolfSSL with ?#2``CFLAGS="-DCRL_MAX_NUM_SZ=40"
    

    For , I am working on it.#3
    

    

    cat crl_revokedCert_02.pem root_cert_1.pem > crl_rootca.pem && wolfssl verify -CAfile crl_rootca.pem -crl_check ca1.pem
verifying certificate file ca1.pem
using CA file crl_rootca.pem
Verification Failed
Err (-362): CRL missing, not loaded
Error returned: -1.


  19. miyazakh commented on Jan 9, 2026 
    @miyazakh
    miyazakh
    on Jan 9, 2026
    Contributor
    @onepeople158
    
Did you recompile wolfSSL with CFLAGS=-DCRL_MAX_NUM_SZ=40 because your CRL number is large, and rebuild wolfCLU accordingly?
  20. onepeople158 commented on Jan 10, 2026 
    @onepeople158
    onepeople158
    on Jan 10, 2026
    Author
    

    @onepeople158 Did you recompile wolfSSL with CFLAGS=-DCRL_MAX_NUM_SZ=40 because your CRL number is large, and rebuild wolfCLU accordingly?
    

    

    I enabled the option CFLAGS=-DCRL_MAX_NUM_SZ=40 and recompiled wolfSSL. Below are the results.
    

    make[2]: warning: -j5 forced in submake: resetting jobserver mode.
verifying certificate file /kaggle/input/isrevoked/ca1.pem
using CA file crl_rootca.pem
Verification Failed
Err (12): unknown error number
Error wolfcrypt/src/asn.c:26058: ASN self-signed certificate error (-275)
Error wolfcrypt/src/asn.c:40570: ASN CRL no signer error to confirm failure (-190)
Error returned: -1.

  21. miyazakh commented on Jan 13, 2026 
    @miyazakh
    miyazakh
    on Jan 13, 2026
    Contributor
    @onepeople158
    
The error code 12 is Err (12): CRL has expired.
    

    This is because your crl is expired.
    

            Last Update: Jan  1 00:00:00 2025 GMT
        Next Update: Dec  1 00:00:00 2025 GMT

    

    Since PR#9628 and PR#9635 have already been merged, I recommend using the latest GitHub versions of wolfSSL and wolfCLU so that you can see the following output.
    

    $ ./wolfssl verify -CAfile crl_rootca.pem -crl_check ca1.pem
verifying certificate file ca1.pem
using CA file crl_rootca.pem
Verification Failed
Err (12): CRL has expired
Error returned: -1.

  22. onepeople158 commented on Jan 14, 2026 
    @onepeople158
    onepeople158
    on Jan 14, 2026
    Author
    

    @onepeople158 The error code 12 is .Err (12): CRL has expired
    

    This is because your crl is expired.
    

            Last Update: Jan  1 00:00:00 2025 GMT
        Next Update: Dec  1 00:00:00 2025 GMT

    

    Since PR#9628 and PR#9635 have already been merged, I recommend using the latest GitHub versions of wolfSSL and wolfCLU so that you can see the following output.
    

    $ ./wolfssl verify -CAfile crl_rootca.pem -crl_check ca1.pem
verifying certificate file ca1.pem
using CA file crl_rootca.pem
Verification Failed
Err (12): CRL has expired
Error returned: -1.

    

    

    I replaced it with a valid CRL file, and wolfSSL indicated that the certificate had been revoked.
    

    make[2]: warning: -j5 forced in submake: resetting jobserver mode.
verifying certificate file /kaggle/input/isrevoked/ca1.pem
using CA file crl_rootca.pem
Verification Failed
Err (23): certificate revoked
Error wolfcrypt/src/asn.c:26058: ASN self-signed certificate error (-275)
Error wolfcrypt/src/asn.c:40570: ASN CRL no signer error to confirm failure (-190)
Error returned: -1.

  23. onepeople158
    closed this as completedon Jan 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
Labels
bug
Type
No type
Projects
No projects
    Milestone
    No milestone
    Relationships
    None yet
    Development
    No branches or pull requests
    Issue actions