<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thanks for the help. This got me on the right track.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Dan<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">openssl-users <openssl-users-bounces@openssl.org><br>
<b>Date: </b>Wednesday, November 11, 2020 at 12:02 PM<br>
<b>To: </b>openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Subject: </b>Re: Deleted client certificate trust expectations<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">External Mail. Careful of links / attachments. Submit Helpdesk if unsure.<br>
<br>
<br>
On Wed, Nov 11, 2020 at 04:28:40PM +0000, Dan Freed wrote:<br>
<br>
> I have a question/issue about how OpenSSL should handle a deleted<br>
> client certificate. It appears that once a trusted certificate is read<br>
> from the filesystem, it remains trusted throughout the lifespan of the<br>
> server process.<br>
<br>
The built-in trust stores (code behind CAfile and CApath) are caching<br>
stores. They use an in memory cache of trusted certificates that is<br>
pre-loaded in the case of CAfile, and demand-loaded on a cache miss in<br>
the case of CApath. Once a certificate is loaded, it remains in the<br>
cache. The cache is part of the X509_STORE object that is associated<br>
with the SSL_CTX.<br>
<br>
Though I don't see it exposed in the Perl API, it is possible to flush<br>
the X509_STORE cache by calling:<br>
<br>
SSL_CTX *ctx;<br>
X509_STORE *store;<br>
STACK_OF(X509) *objs;<br>
X509 *x;<br>
<br>
...<br>
store = SSL_CTX_get_cert_store(ctx);<br>
X509_STORE_lock(store);<br>
st = X509_STORE_get0_objects(store);<br>
while ((x = sk_X509_pop(st)) != NULL)<br>
X509_free(x);<br>
X509_STORE_unlock(store);<br>
....<br>
<br>
An application that uses only CApath and does not wish to cache trusted<br>
certificates indefinitely, can use this to flush the cache. Note that<br>
this does not work well with CAfile, since the file is read just once,<br>
so you'd need to explicitly reload the CAfile:<br>
<br>
lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());<br>
if (lookup == NULL)<br>
return 0;<br>
if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1)<br>
return 0;<br>
<br>
But keep in mind that X509_LOOKUP_load_file is not atomic, it adds<br>
certificates to the store one at a time. Therefore flushing and<br>
reloading the store should happen in the same thread and should not<br>
happen concurrently in multiple threads.<br>
<br>
A sufficiently sophisticated user can of course add a custom store<br>
that uses no cache, or a more sophisticated cache with expiration<br>
times, ...<br>
<br>
> My understanding of how this should work was that it should read the<br>
> contents of that directory at the time the verify takes place, not<br>
> when CTX_set_verify() is called, but that doesn't seem to be what is<br>
> happening.<br>
<br>
The directory content is (partly) cached, with the cache growing<br>
incrementally as additional certificates are loaded.<br>
<br>
--<br>
Viktor.<o:p></o:p></p>
</div>
</div>
</body>
</html>