Jira (PUP-3788) Puppet Agent does not support Chained CRLs

[Andreas Paul (JIRA)]

Title: Message Title

Andreas Paul commented on PUP-3788   Re: Puppet Agent does not support Chained CRLs I started digging through the Puppet agent CRL code, trying to find the point where the agent loads the CRL file and only found this function: https://github.com/puppetlabs/puppet/blob/master/lib/puppet/ssl/certificate_revocation_list.rb#L17 Is this the function that I was looking for or is there something else using OpenSSL::X509::CRL to create a CRL from the disk file? If it is the correct function then I don't know how the loading of multiple CRLs from one file did ever work in Puppet, because OpenSSL::X509::CRL.new(crl_bundle_string) only returns the first CRL just like the openssl binary: $ curl -s -o crl_bundle.pem https://tickets.puppetlabs.com/secure/attachment/17918/crl_bundle.pem && irb irb(main):001:0> require 'openssl' => true irb(main):002:0> crl_bundle_string = File.open('./crl_bundle.pem').read() => "-----BEGIN X509 CRL-----\nMIIB2jCBwzANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJVUzEPMA0GA1UECBMG\nT3JlZ29uMRQwEgYDVQQKEwtQdXBwZXQgTGFiczEUMBIGA1UECxMLRW5naW5lZXJp\nbmcxMTAvBgNVBAMUKHN6eGtqb3c0YWU0YTR6dC5kZWxpdmVyeS5wdXBwZXRsYWJz\nLm5ldAoXDTE1MDEyNzIwNTk1MVoXDTE2MDEyNzIwNTk1MVowFTATAgIQBRcNMTUw\nMTI3MjA1OTUxWjANBgkqhkiG9w0BAQUFAAOCAQEAFs4G+3TsRN6ju5BrkUQJook8\nsLpCi237WU5vQZjVElEmRbDHtT7QgriCj2ftNB8z7R0RgPqdI9FSwJUrYIwuU/uO\nSW7FRPbBZQc+jzLBLyB/29ybKpgvyI84YGiberNSEQResU14oMIySZrQm+3nxm7t\noQf0l7STgbpsVUKRtyC/OsAfYoUhJW1HDvqQTsmda+fu5zVdalrGsmH4ufZGYPav\nLloontjU3QFnPSFwUSRccK/oBhX3e6SKaHKMetvAtyFhsDI03rNLmJFG6QiA2B5+\nKNk7RIPVqyAW5BM9xNGExfcAsG09J5DSgER3diJI5qaehzvgHl2mt2emCVsGIQ==\n-----END X509 CRL-----\n-----BEGIN X509 CRL-----\nMIIB7TCB1jANBgkqhkiG9w0BAQUFADCBkDELMAkGA1UEBhMCVVMxDzANBgNVBAgT\nBk9yZWdvbjERMA8GA1UEBxMIUG9ydGxhbmQxFDASBgNVBAoTC1B1cHBldCBMYWJz\nMTEwLwYDVQQDFChzenhram93NGFlNGE0enQuZGVsaXZlcnkucHVwcGV0bGFicy5u\nZXQKMRQwEgYDVQQLEwtFbmdpbmVlcmluZxcNMTUwMTI3MjA1OTQ5WhcNMTYwMTI3\nMjA1OTQ5WjAUMBICAQEXDTE1MDEyNzIwNTk0OVowDQYJKoZIhvcNAQEFBQADggEB\nACG8Wy0oyyyEAtEzTdfolxPWuf0uq0uxYxkZW3Z5H021KAx0IsrIyccTSRkwIPpv\nmjEJWjUx82gWXsgp7UJkjs8Ys3t4CcpHg2T6tqr7MxQDc2iaKdCNzZdP7ViHMiwy\nar9uUle6nm9RBKV9rQ2Mk+4tECs/85aL9dTNpatLab1D2kDS7WbqWx7ArYcbvdWI\nNEHnQ8rkGqLlRBcfpV5c4M3Oq3/yGKbe5RUAMfdwcwYLibccyYSLrCTRZvJWVhUX\nSurhaffqC7sYf11pNWwPs0Z9pF9JwIU3tx7IBYZ5sdShvsW6FR+D5/3xR9aoxDFM\nHimM1WcUrP47HrnFawLxOHs=\n-----END X509 CRL-----\n" irb(main):003:0> OpenSSL::X509::CRL.new(crl_bundle_string) => -----BEGIN X509 CRL----- MIIB2jCBwzANBgkqhkiG9w0BAQUFADB9MQswCQYDVQQGEwJVUzEPMA0GA1UECBMG T3JlZ29uMRQwEgYDVQQKEwtQdXBwZXQgTGFiczEUMBIGA1UECxMLRW5naW5lZXJp bmcxMTAvBgNVBAMUKHN6eGtqb3c0YWU0YTR6dC5kZWxpdmVyeS5wdXBwZXRsYWJz Lm5ldAoXDTE1MDEyNzIwNTk1MVoXDTE2MDEyNzIwNTk1MVowFTATAgIQBRcNMTUw MTI3MjA1OTUxWjANBgkqhkiG9w0BAQUFAAOCAQEAFs4G+3TsRN6ju5BrkUQJook8 sLpCi237WU5vQZjVElEmRbDHtT7QgriCj2ftNB8z7R0RgPqdI9FSwJUrYIwuU/uO SW7FRPbBZQc+jzLBLyB/29ybKpgvyI84YGiberNSEQResU14oMIySZrQm+3nxm7t oQf0l7STgbpsVUKRtyC/OsAfYoUhJW1HDvqQTsmda+fu5zVdalrGsmH4ufZGYPav LloontjU3QFnPSFwUSRccK/oBhX3e6SKaHKMetvAtyFhsDI03rNLmJFG6QiA2B5+ KNk7RIPVqyAW5BM9xNGExfcAsG09J5DSgER3diJI5qaehzvgHl2mt2emCVsGIQ== -----END X509 CRL-----   irb(main):004:0> Add Comment   This message was sent by Atlassian JIRA (v6.4.5#64020-sha1:78acd6c) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.