Description

This branch implements support for generating RFC 5280 Certificate Revocation Lists (CRLs) using rcgen.

My primary motivation for this work is to offer the ecosystem a pure-Rust method for generating CRLs that will work with Rustls as part of in-progress support for client certificate revocation checking. As such, this work doesn't attempt to offer all possible CRL features but a minimal subset I think makes the most sense as a starting point.

I've done my best to match the style of the crate for this new feature, but as this is my first contribution there may be room for further improvements.

Resolves #109

CertificateParams: lift write_extension fn.

Previously the CertificateParams type defined a member function, write_extension, that could serialize X509 extensions per RFC 5280.

Conveniently, Certificate revocation lists (CRLs) use the exact same mechanism for both CRL and revoked cert extensions.

In preparation for supporting generation of CRLs this commit lifts the existing function into a free-standing version, renamed to
write_x509_extension. The existing CertificateParams code is updated to use this function.

CertificateParams: lift AKI extension fn.

Previously the CertificateParams type's write_cert fn had a code fragment used to write the authority key identifier (AKI) extension defined by RFC 5280 Section 4.2.1.1.

Later, in RFC 5280 Section 5.2.1, there is text saying:

Conforming CRL issuers MUST use the key identifier method, and MUST
include this extension in all CRLs issued.

Conveniently, the AKI extension implementation for CRLs is identical to certificates. Both use the definition from 4.2.1.1.

In preparation for supporting generation of CRLs that adhere to the specification this commit lifts the existing code for AKI serialization to a free-standing version named write_x509_authority_key_identifier. The existing CertificateParams.write_cert code is updated to use this function.

lib: add support for creating CRLs.

This commit introduces support for generating signed Certificate Revocation Lists (CRLs) according to the profile defined in RFC 5280 Section 5.

This implementation closely follows the feature set (soon to be) supported by the Rustls webpki crate. It is not a complete implementation of all possible CRL features. Notably it doesn't support:

• Indirect CRLs - that is, CRLs that have revoked certificates issued by an issuer separate from the issuer of the CRL.
• Delta CRLs - that is, CRLs that only include the differences from a previously issued CRL.

There is also limited flexibility for issuing CRLs that don't adhere to 5280. E.g. specifying an incorrect version, omitting a CRL number, omitting the authority key identifier extenion. These are required by 5280 so let's please not pollute the world with more out-of-spec DER. I assume anyone needing to generate malformed things on purpose can use tools like der-ascii instead.

tests: add certificate revocation list tests.

This commit adds tests that ensure rcgen created CRLs parse/validate successfully with OpenSSL and x509-parser.

Coverage is not added for Botan because it appears the Botan rust bindings don't expose the required X509_CRL type (randombit/botan-rs#95).

Coverage is not (yet) added for Webpki because the upstream crate hasn't yet cut a release that includes CRL parsing support. I've started on this test coverage (see 37ada8d) but since it will require a Cargo patch to use the unreleased rustls/webpki I've held off on completing that work or including it for review.