Erlang check .pem certificate is not revoked with .crl file - ssl

Question

I am trying to implement offline check for certificate based on data from .CRL (certificate revoked list) files
I checked pkix validation and crl api but did not find any examples of using
Assume I have list of providers, list of CRL files of provider (revoked and partially revoked), and some .pem file to check
Any ideas how this check should be implemented?

Answer 1

You can use the crl_check and crl_cache options:
ssl:connect("www.google.com", 443,
[{verify, verify_peer},
{crl_check, true},
{crl_cache, {ssl_crl_hash_dir, {internal, [{dir, "/path/to/crls/"}]}}}]).
The ssl_crl_hash_dir module expects to find a directory containing all CRLs with file names in a very specific format, e.g. 1a2b3c4d.r0, where the first eight characters are a hash of certain parts of the certificate, and the trailing .r0 is a CRL revision number. The c_rehash utility, which comes with OpenSSL, can set up symlinks matching that format.
ssl_crl_hash_dir lets you do CRL checks completely offline, unlike ssl_crl_cache, which attempts to download CRLs from the designated server.
To prepare the CRL directory, let's say we downloaded Google's CRL:
wget http://crl.pki.goog/GTSGIAG3.crl
Unfortunately, it's in DER format, so c_rehash doesn't understand it (and neither will ssl_crl_hash_dir). Let's recode it:
openssl crl -in GTSGIAG3.crl -inform DER -outform PEM -out GTSGIAG3-pem.crl
Now, we can run c_rehash, giving the current directory as argument:
$ c_rehash .
Doing .
WARNING: GTSGIAG3.crl does not contain a certificate or CRL: skipping
It has created two symlinks for us:
$ ls -go
total 8
lrwxrwxrwx 1 16 Jul 23 16:28 6a909d98.r0 -> GTSGIAG3-pem.crl
lrwxrwxrwx 1 16 Jul 23 16:28 a11dd888.r0 -> GTSGIAG3-pem.crl
-rw-rw-r-- 1 635 Jul 23 03:15 GTSGIAG3.crl
-rw-rw-r-- 1 910 Jul 23 16:28 GTSGIAG3-pem.crl
The hashes in those symlinks are the ones returned by openssl crl -hash and openssl crl -hash_old:
$ openssl crl -hash -noout -in GTSGIAG3-pem.crl
6a909d98
$ openssl crl -hash_old -noout -in GTSGIAG3-pem.crl
a11dd888

Answer 2

Get serial numbers of revoked certificates:
{ok, Bytes} = file:read_file("/Users/Downloads/CA-4E6929B9-Delta.crl").
public_key:der_decode('CertificateList', Bytes).
Return
public_key:der_decode('CertificateList', Bytes).
{'CertificateList',{'TBSCertList',v2,
{'AlgorithmIdentifier',{1,2,804,2,1,1,1,1,3,1,1},
asn1_NOVALUE},
{rdnSequence,[[{'AttributeTypeAndValue',{2,5,4,10},
<<12,28,208,162,208,158,208,146,32,34,208,144,208,160,
208,162,...>>}],
[{'AttributeTypeAndValue',{2,5,4,11},
<<12,8,208,144,208,166,208,161,208,154>>}],
[{'AttributeTypeAndValue',{2,5,4,3},
<<12,49,208,144,208,166,208,161,208,154,32,34,77,65,...>>}],
[{'AttributeTypeAndValue',{2,5,4,5},
<<12,14,85,65,45,51,48,52,48,52,55,53,48,...>>}],
[{'AttributeTypeAndValue',{2,5,4,6},<<19,2,85,65>>}],
[{'AttributeTypeAndValue',{2,5,4,7},
<<12,8,208,154,208,184,209,151,208,178>>}]]},
{utcTime,"180720162130Z"},
{utcTime,"180720182130Z"},
[{'TBSCertList_revokedCertificates_SEQOF',447646493074184995506808756600724219093179699200,
{utcTime,"180715102900Z"},
[{'Extension',{2,5,29,21},false,<<10,1,0>>},
{'Extension',{2,5,29,24},
false,
<<24,15,50,48,49,56,48,55,49,...>>}]},
{'TBSCertList_revokedCertificates_SEQOF',447646493074184995506808756600724219093196476416,
{utcTime,"180715102900Z"},
[{'Extension',{2,5,29,21},false,<<10,1,0>>},
{'Extension',{2,5,29,24},
false,
<<24,15,50,48,49,56,48,55,...>>}]},
{'TBSCertList_revokedCertificates_SEQOF',447646493074184995506808756600868334281322663936,
{utcTime,"180715103000Z"}, ...
Check serialNumber of certificate is not in list