Function VerifyCRLEndpoint

command/certificate/verify.go:416–456

(endpoint string, cert, issuer *x509.Certificate, httpClient *http.Client, insecure bool)

}

func VerifyCRLEndpoint(endpoint string, cert, issuer *x509.Certificate, httpClient *http.Client, insecure bool) (bool, error) {
	resp, err := httpClient.Get(endpoint)
	if err != nil {
		return false, errors.Wrap(err, "error downloading crl")
	}
	defer resp.Body.Close()

	if resp.StatusCode >= 400 {
		return false, errors.Errorf("error downloading crl: status code %d", resp.StatusCode)
	}

	b, err := io.ReadAll(resp.Body)
	if err != nil {
		return false, errors.Wrap(err, "error downloading crl")
	}

	crl, err := x509.ParseRevocationList(b)
	if err != nil {
		return false, errors.Wrap(err, "error parsing crl")
	}

	crlJSON, err := crlutil.ParseCRL(b)
	if err != nil {
		return false, errors.Wrap(err, "error parsing crl into json")
	}

	if issuer != nil && !insecure {
		err = crl.CheckSignatureFrom(issuer)
		if err != nil {
			return false, errors.Wrap(err, "error validating the CRL against the CA issuer")
		}
	}

	for _, revoked := range crlJSON.RevokedCertificates {
		if cert.SerialNumber.String() == revoked.SerialNumber {
			return true, errors.Errorf("certificate marked as revoked in CRL %s", endpoint)
		}
	}

	return true, nil
}