Running the test suite against OpenSSL 3.5.9 (on Fedora), TestCrlSupport has
6 failures.
According to AI (I haven't investigated further):
"The CRL fixtures
test/org/apache/tomcat/util/net/{empty,populated}-crl.pem are signed with
sha1WithRSAEncryption. OpenSSL 3.5 (and Fedora's crypto policy) refuse to
verify
a SHA-1 signature, so the CRL check fails with 'CRL signature failure' and
the
server rejects otherwise-valid client certificates. The CA certificate
itself is
SHA-256; only the CRLs are SHA-1. JSSE trust passes because it is lenient
about
the CRL signature."
keytool -exportcert -rfc -keystore user1.jks -storepass changeit -alias
user1 > user1.pem
openssl verify -crl_check -CAfile ca-cert.pem -CRLfile populated-crl.pem
user1.pem
=> error 8 ... CRL signature failure (do_sigver_init: invalid digest)
OPENSSL_ENABLE_SHA1_SIGNATURES=1 openssl verify -crl_check \
-CAfile ca-cert.pem -CRLfile populated-crl.pem user1.pem
=> user1.pem: OK
I think that the CRLs should be regenerated with SHA-256.
Kind regards,
Dimitris
