Skip to content

Extend AIA interface #9728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
padelsbach wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Extend AIA interface #9728

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa020f3
Extend AIA interface
padelsbach Jan 26, 2026
3968669
Enable 8 combined OCSP and URLs instead of 1 of each
padelsbach Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,3 +470,6 @@ wolfssl/debug-trace-error-codes.h
wolfssl/debug-untrace-error-codes.h

AGENTS.md

# Code navigation files
compile_commands.json
20 changes: 20 additions & 0 deletions certs/aia/ca-issuers-cert.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
-----BEGIN CERTIFICATE-----
MIIDUDCCAjigAwIBAgIUQy4lyOzJcvFVekNsQWuUegW0kGgwDQYJKoZIhvcNAQEL
BQAwGzEZMBcGA1UEAwwQd29sZnNzbC1haWEtdGVzdDAeFw0yNjAxMjYyMzE1NTZa
Fw0yNzAxMjYyMzE1NTZaMBsxGTAXBgNVBAMMEHdvbGZzc2wtYWlhLXRlc3QwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDM1vUyiX+qtPFhhEqZq3bCUKpd
6QtswO7YWj+us79yh99mIGE7EZlSfTv0n3rn2//m5bQ7a+TSYMkDyNjPEH6Z+ub2
qW4EJyc4J9DfC+T9gJM4dvsij+F8TUne/o5iCwFdiZEycEj0vtyYh53du3oqlZTY
yt8q4k5INoTl+ELCX/L0YqR/+Fl2qaloK7YHUb3EdSqBEGoa/IEfnxHMreZWhVYd
pSdDnT9rfNqT5Kb2e+eZbZZSouEmebhx9ioRfIXDadSCCa1JNp4fO3YlcDmmEahx
6TcjEmhUt80+hjhJhqrh4vPlxI24qHmfOe+k2qSimpJse/AUuz7wGRjx6ktfAgMB
AAGjgYswgYgwHQYDVR0OBBYEFMvT3KE5dvI6t3KNrcuctkm6wvXMMB8GA1UdIwQY
MBaAFMvT3KE5dvI6t3KNrcuctkm6wvXMMA8GA1UdEwEB/wQFMAMBAf8wNQYIKwYB
BQUHAQEEKTAnMCUGCCsGAQUFBzAChhlodHRwOi8vZXhhbXBsZS5jb20vY2EucGVt
MA0GCSqGSIb3DQEBCwUAA4IBAQCjxEHOlxVfmE8xgcQCnr1b4IK5EBuIMUaS7lko
AHmHvj7z9rr2cxbJhGYQxcttZ4/SQldRqpmiB0cUmko4LbD9yos4FKlyGe3xWvKa
W17SdpJU2PREShGLLqP7bwiWV6wVyo6puwDHLYSjH5vYr+IcSNNc0GuMZg1OhTWt
2PYG2vGbHoNR0/UyNibGmaPBimg0nb2GTizY7yWm+N/yXnWa6Wc5yyiF1zExw/GO
8O/rF0Lg/Gy/v6LnnNmhSOr9ENPKgQEAHFmJRXBXqDYUNhcm2U3PzlfBa06SHFcr
b59n5jgJmcNSwYDJAYKEhMvjBL40DmiWaRfol2DPoIZ7YtRf
-----END CERTIFICATE-----
23 changes: 23 additions & 0 deletions certs/aia/multi-aia-cert.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
-----BEGIN CERTIFICATE-----
MIIDwTCCAqmgAwIBAgIUEcNoHSMtIkVhW/MmkmUEsVoJVQEwDQYJKoZIhvcNAQEL
BQAwITEfMB0GA1UEAwwWd29sZnNzbC1haWEtbXVsdGktdGVzdDAeFw0yNjAxMjcw
MTUwNDRaFw0yNzAxMjcwMTUwNDRaMCExHzAdBgNVBAMMFndvbGZzc2wtYWlhLW11
bHRpLXRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpVdogPQ2I
/nErbxSaNGoYhkwoj1qt+Be1/qWnvZzJ0EBOG4EdioMRIkJzP6W3HoAhkGBrueXf
riN07M3XLocRfE+9C1+jZQxBGRxysns9z7K+i0pBtPN/AXV2RCSz13FFyVyLhLks
2YAL9By36X9R0wsL+Nd4EAQ4ouf0GglmTmtb5rHf2GIno4xFg9tpWosiUTytwgDC
K9lQEQnTnPG6E43N2bszqBc4roOPrYDnd7raNTqcv9yTHM8zwffGJuCogE/Fbr2R
yVubLW28n5/O1Pb47hHuPJv6oHMZgct2SV5OB/mwVgI0eoFMSQZ35o6BpHD0C497
L2IcoMi8A9rFAgMBAAGjgfAwge0wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAoQw
gbAGCCsGAQUFBwEBBIGjMIGgMCIGCCsGAQUFBzABhhZodHRwOi8vMTI3LjAuMC4x
OjIyMjIxMCIGCCsGAQUFBzABhhZodHRwOi8vMTI3LjAuMC4xOjIyMjIyMCkGCCsG
AQUFBzAChh1odHRwOi8vd3d3LndvbGZzc2wuY29tL2NhLnBlbTArBggrBgEFBQcw
AoYfaHR0cHM6Ly93d3cud29sZnNzbC5jb20vY2EyLnBlbTAdBgNVHQ4EFgQU1GNm
eP/LXQk0tFaTeWoNHyLhLZkwDQYJKoZIhvcNAQELBQADggEBACwuXdKYI2Q/Vhd7
TJFvKdp7BuUopQGEQ+4vR+FoesYXc9MHjZJfMqEffv1MArTeY46At/zvcTeszagi
io+jjGBLOutsAf9WK3PnKMIkGGfro6btZ8QFyKiZ6unMMlqe6cGqrCrNKp8jLP3k
CKZltR5c+MIPhpjoOhNDMOcPMwZBGQJWubwOb4uOu3wv7UWJk/ovKP9WJCUn6wLH
soDs+MHMICkxOvDfPf+F4URVqTbzE8IvSMv38z4cAqsyEfWxr32Dg34S/NmeePFV
7sSDpksvyITGsxjnQulSuUFSmldumQ6GnA4ZUXvCNdJ0zbD/Iib9ud6K05VdWYZP
uyCRkjY=
-----END CERTIFICATE-----
26 changes: 26 additions & 0 deletions certs/aia/overflow-aia-cert.pem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
-----BEGIN CERTIFICATE-----
MIIEcDCCA1igAwIBAgIUN5kIU1GLRP5bRKctP271p7IGFVowDQYJKoZIhvcNAQEL
BQAwJDEiMCAGA1UEAwwZd29sZnNzbC1haWEtb3ZlcmZsb3ctdGVzdDAeFw0yNjAx
MjcwMTU1NTBaFw0yNzAxMjcwMTU1NTBaMCQxIjAgBgNVBAMMGXdvbGZzc2wtYWlh
LW92ZXJmbG93LXRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDS
eHeAzVuCe44SU8bcyIWLwkA2AABw/ctSBWKAFEd7DYHduRr3diblHERU1Fv5JzYx
JnZquj1IO/qsnSFJYDc9sQmYea89iW8KNPVXKDzdbzhpiQLZL7Yq71ICxxqVLfRr
91lyAj0+Syncrp96olSpMJochVnQ6PqLcc/Gq7CMtrKn5KAN7Mn3+LdAQYU8JjRa
zqEJ8fmkBKbS5watzgnkP2o5jWSpWzpDOxTdw85hju4H9m5Gmun3XVO9dEAN/dqK
vklkzgQGvAMMQMIcgOzw0HxAuvsSNtjgEpIlOir0M7YiC0pYqtMO+thSCmVCvsDR
/nG/iqe6YBSXh6oszGwTAgMBAAGjggGYMIIBlDAMBgNVHRMEBTADAQH/MAsGA1Ud
DwQEAwIChDCCAVYGCCsGAQUFBwEBBIIBSDCCAUQwIgYIKwYBBQUHMAGGFmh0dHA6
Ly8xMjcuMC4wLjE6MjIyMjAwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6
MjIyMjEwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjIwIgYIKwYB
BQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjMwIgYIKwYBBQUHMAGGFmh0dHA6
Ly8xMjcuMC4wLjE6MjIyMjQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6
MjIyMjUwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjYwIgYIKwYB
BQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjcwIgYIKwYBBQUHMAGGFmh0dHA6
Ly8xMjcuMC4wLjE6MjIyMjgwHQYDVR0OBBYEFJt6TNgqMFBebotXaauIYPpUJi1S
MA0GCSqGSIb3DQEBCwUAA4IBAQA5noHB343sKQqVmmLds0gC/k1UhVA5iftAGmes
uRdNOOCdo2i739DmRAXggetgtatcjDfjxkrvq0Qi+geozZra6uX9FT/hgfw6kDpU
HKzJFy4E0G0HTM8mtJi+aGDZL3Lts+h272eahkT1jVKGAPFugqfz7fKRsMce6eCE
UD5cvtQXX16fGhBxxmUCZPnxMKcj2oNl7RliHphK6ofXuNbKjqjVQfxsTUXSQDyS
ApH5w6iUnAvC5l19qYrBcCVOB6CNJ2CdmvFI//Ox8Jc56HRYYDIdVp2Q3FFA5Z4s
gTLvlumVgihAekD+0zVF9q+AJ4TSbE3cqsQgHF/+p84KxWid
-----END CERTIFICATE-----
4 changes: 3 additions & 1 deletion certs/crl/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,9 @@ EXTRA_DIST += \
EXTRA_DIST += \
certs/crl/crl.revoked \
certs/crl/extra-crls/ca-int-cert-revoked.pem \
certs/crl/extra-crls/general-server-crl.pem
certs/crl/extra-crls/general-server-crl.pem \
certs/crl/extra-crls/large_crlnum.pem \
certs/crl/extra-crls/large_crlnum2.pem

# Intermediate cert CRL's
EXTRA_DIST += \
Expand Down
6 changes: 5 additions & 1 deletion certs/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,11 @@ EXTRA_DIST += \
certs/dh-pub-2048.pem \
certs/dsa2048.pem

EXTRA_DIST += \
certs/aia/ca-issuers-cert.pem \
certs/aia/multi-aia-cert.pem \
certs/aia/overflow-aia-cert.pem

EXTRA_DIST += \
certs/ca-key.der \
certs/ca-cert.der \
Expand Down Expand Up @@ -154,4 +159,3 @@ include certs/sphincs/include.am
include certs/rpk/include.am
include certs/acert/include.am
include certs/mldsa/include.am

57 changes: 57 additions & 0 deletions certs/renewcerts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@
# fpki-cert.der
# fpki-certpol-cert.der
# rid-cert.der
# aia/ca-issuers-cert.pem
# aia/multi-aia-cert.pem
# aia/overflow-aia-cert.pem
# updates the following crls:
# crl/cliCrl.pem
# crl/crl.pem
Expand Down Expand Up @@ -292,6 +295,60 @@ run_renewcerts(){
echo "End of section"
echo "---------------------------------------------------------------------"
############################################################
########## update AIA test certs ###########################
############################################################
echo "Updating AIA test certs"
echo ""
mkdir -p aia

echo "Updating aia/ca-issuers-cert.pem"
echo ""
openssl req -new -newkey rsa:2048 -nodes -keyout aia/ca-issuers-key.pem -subj "/CN=wolfssl-aia-test" -out aia/ca-issuers-cert.csr
check_result $? "Step AIA-1"

openssl x509 -req -in aia/ca-issuers-cert.csr -days 365 -extfile wolfssl.cnf -extensions aia_ca_issuers -signkey aia/ca-issuers-key.pem -out aia/ca-issuers-cert.pem
check_result $? "Step AIA-2"
rm aia/ca-issuers-cert.csr

openssl x509 -in aia/ca-issuers-cert.pem -text > tmp.pem
check_result $? "Step AIA-3"
mv tmp.pem aia/ca-issuers-cert.pem
rm aia/ca-issuers-key.pem
echo "End of section"
echo "---------------------------------------------------------------------"

echo "Updating aia/multi-aia-cert.pem"
echo ""
openssl req -new -newkey rsa:2048 -nodes -keyout aia/multi-aia-key.pem -subj "/CN=wolfssl-aia-multi-test" -out aia/multi-aia-cert.csr
check_result $? "Step AIA-4"

openssl x509 -req -in aia/multi-aia-cert.csr -days 365 -extfile wolfssl.cnf -extensions aia_multi -signkey aia/multi-aia-key.pem -out aia/multi-aia-cert.pem
check_result $? "Step AIA-5"
rm aia/multi-aia-cert.csr

openssl x509 -in aia/multi-aia-cert.pem -text > tmp.pem
check_result $? "Step AIA-6"
mv tmp.pem aia/multi-aia-cert.pem
rm aia/multi-aia-key.pem
echo "End of section"
echo "---------------------------------------------------------------------"

echo "Updating aia/overflow-aia-cert.pem"
echo ""
openssl req -new -newkey rsa:2048 -nodes -keyout aia/overflow-aia-key.pem -subj "/CN=wolfssl-aia-overflow-test" -out aia/overflow-aia-cert.csr
check_result $? "Step AIA-7"

openssl x509 -req -in aia/overflow-aia-cert.csr -days 365 -extfile wolfssl.cnf -extensions aia_overflow -signkey aia/overflow-aia-key.pem -out aia/overflow-aia-cert.pem
check_result $? "Step AIA-8"
rm aia/overflow-aia-cert.csr

openssl x509 -in aia/overflow-aia-cert.pem -text > tmp.pem
check_result $? "Step AIA-9"
mv tmp.pem aia/overflow-aia-cert.pem
rm aia/overflow-aia-key.pem
echo "End of section"
echo "---------------------------------------------------------------------"
############################################################
########## update the self-signed ca-cert-chain.der ########
############################################################
echo "Updating ca-cert-chain.der"
Expand Down
40 changes: 39 additions & 1 deletion certs/renewcerts/wolfssl.cnf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,6 +321,45 @@ keyUsage=critical, digitalSignature, keyCertSign, cRLSign
[ crl_dist_points ]
crlDistributionPoints=URI:http://www.wolfssl.com/crl.pem

# AIA test certs
[ aia_ca_issuers ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
basicConstraints=critical,CA:true
authorityInfoAccess=@aia_ca_issuers_info

[ aia_ca_issuers_info ]
caIssuers;URI.0=http://example.com/ca.pem

[ aia_multi ]
subjectKeyIdentifier=hash
basicConstraints=CA:true
keyUsage=digitalSignature, keyCertSign
authorityInfoAccess=@aia_multi_info

[ aia_multi_info ]
OCSP;URI.0=http://127.0.0.1:22221
OCSP;URI.1=http://127.0.0.1:22222
caIssuers;URI.0=http://www.wolfssl.com/ca.pem
caIssuers;URI.1=https://www.wolfssl.com/ca2.pem

[ aia_overflow ]
subjectKeyIdentifier=hash
basicConstraints=CA:true
keyUsage=digitalSignature, keyCertSign
authorityInfoAccess=@aia_overflow_info

[ aia_overflow_info ]
OCSP;URI.0=http://127.0.0.1:22220
OCSP;URI.1=http://127.0.0.1:22221
OCSP;URI.2=http://127.0.0.1:22222
OCSP;URI.3=http://127.0.0.1:22223
OCSP;URI.4=http://127.0.0.1:22224
OCSP;URI.5=http://127.0.0.1:22225
OCSP;URI.6=http://127.0.0.1:22226
OCSP;URI.7=http://127.0.0.1:22227
OCSP;URI.8=http://127.0.0.1:22228

#tsa default
[ tsa ]
default_tsa = tsa_config1
Expand Down Expand Up @@ -404,4 +443,3 @@ DNS.1 = www.example.org
URI.1 = https://www.wolfssl.com/
otherName.2 = 2.16.840.1.101.3.6.6;FORMAT:HEX,OCT:D1:38:10:D8:28:AF:2C:10:84:35:15:A1:68:58:28:AF:02:10:86:A2:84:E7:39:C3:EB


28 changes: 28 additions & 0 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13848,6 +13848,34 @@ int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
}
x509->authInfoSet = dCert->extAuthInfoSet;
x509->authInfoCrit = dCert->extAuthInfoCrit;
x509->authInfoListSz = dCert->extAuthInfoListSz;
x509->authInfoListOverflow = dCert->extAuthInfoListOverflow;
if (x509->authInfoListSz > WOLFSSL_MAX_AIA_ENTRIES) {
x509->authInfoListSz = WOLFSSL_MAX_AIA_ENTRIES;
x509->authInfoListOverflow = 1;
}
if (x509->authInfoListSz > 0) {
int i;
for (i = 0; i < x509->authInfoListSz; i++) {
x509->authInfoList[i].method = dCert->extAuthInfoList[i].method;
x509->authInfoList[i].uriSz = dCert->extAuthInfoList[i].uriSz;
x509->authInfoList[i].uri = NULL;

if (dCert->extAuthInfoList[i].uri != NULL &&
dCert->source != NULL && dCert->maxIdx > 0 &&
x509->derCert != NULL && x509->derCert->buffer != NULL) {
word32 offset = (word32)
(dCert->extAuthInfoList[i].uri - dCert->source);
if (offset < (word32)dCert->maxIdx) {
x509->authInfoList[i].uri =
x509->derCert->buffer + offset;
}
else {
x509->authInfoList[i].uriSz = 0;
}
}
}
}
if (dCert->extAuthInfo != NULL && dCert->extAuthInfoSz > 0) {
x509->authInfo = (byte*)XMALLOC(dCert->extAuthInfoSz, x509->heap,
DYNAMIC_TYPE_X509_EXT);
Expand Down
107 changes: 93 additions & 14 deletions src/x509.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14996,30 +14996,109 @@ void wolfSSL_X509_email_free(WOLF_STACK_OF(WOLFSSL_STRING) *sk)
}
}

WOLF_STACK_OF(WOLFSSL_STRING) *wolfSSL_X509_get1_ocsp(WOLFSSL_X509 *x)
static WOLFSSL_STACK* x509_aia_append_string(WOLFSSL_STACK** head,
const byte* uri, word32 uriSz)
{
WOLFSSL_STACK* list = NULL;
WOLFSSL_STACK* node;
char* url;

if (x == NULL || x->authInfoSz == 0)
node = (WOLFSSL_STACK*)XMALLOC(sizeof(WOLFSSL_STACK) + uriSz + 1, NULL,
DYNAMIC_TYPE_OPENSSL);
if (node == NULL)
return NULL;

list = (WOLFSSL_STACK*)XMALLOC(sizeof(WOLFSSL_STACK) + x->authInfoSz + 1,
NULL, DYNAMIC_TYPE_OPENSSL);
if (list == NULL)
url = (char*)node;
url += sizeof(WOLFSSL_STACK);
XMEMCPY(url, uri, uriSz);
url[uriSz] = '\0';

node->data.string = url;
node->next = NULL;
node->num = 1;

if (*head == NULL) {
*head = node;
}
else {
WOLFSSL_STACK* cur = *head;
while (cur->next != NULL) {
cur->num++;
cur = cur->next;
}
cur->num++;
cur->next = node;
}

return node;
}

static WOLFSSL_STACK* x509_get1_aia_by_method(WOLFSSL_X509* x, word32 method,
const byte* fallback, int fallbackSz)
{
WOLFSSL_STACK* head = NULL;
int i;

if (x == NULL)
return NULL;

url = (char*)list;
url += sizeof(WOLFSSL_STACK);
XMEMCPY(url, x->authInfo, x->authInfoSz);
url[x->authInfoSz] = '\0';
/* Build from multi-entry list when available; otherwise fall back to the
* legacy single-entry fields to preserve previous behavior. */
if (x->authInfoListSz > 0) {
for (i = 0; i < x->authInfoListSz; i++) {
if (x->authInfoList[i].method != method ||
x->authInfoList[i].uri == NULL ||
x->authInfoList[i].uriSz == 0) {
continue;
}

if (x509_aia_append_string(&head, x->authInfoList[i].uri,
x->authInfoList[i].uriSz) == NULL) {
wolfSSL_X509_email_free(head);
return NULL;
}
}
}
if (head == NULL && fallback != NULL && fallbackSz > 0) {
if (x509_aia_append_string(&head, fallback, (word32)fallbackSz) == NULL) {
wolfSSL_X509_email_free(head);
return NULL;
}
}

return head;
}

list->data.string = url;
list->next = NULL;
list->num = 1;
WOLF_STACK_OF(WOLFSSL_STRING) *wolfSSL_X509_get1_ocsp(WOLFSSL_X509 *x)
{
if (x == NULL)
return NULL;
return x509_get1_aia_by_method(x, AIA_OCSP_OID, x->authInfo, x->authInfoSz);
}

return list;
int wolfSSL_X509_get_aia_overflow(WOLFSSL_X509 *x)
{
int overflow = 0;

WOLFSSL_ENTER("wolfSSL_X509_get_aia_overflow");

if (x != NULL) {
overflow = x->authInfoListOverflow;
}

WOLFSSL_LEAVE("wolfSSL_X509_get_aia_overflow", overflow);

return overflow;
}

#ifdef WOLFSSL_ASN_CA_ISSUER
WOLF_STACK_OF(WOLFSSL_STRING) *wolfSSL_X509_get1_ca_issuers(WOLFSSL_X509 *x)
{
if (x == NULL)
return NULL;
return x509_get1_aia_by_method(x, AIA_CA_ISSUER_OID, x->authInfoCaIssuer,
x->authInfoCaIssuerSz);
}
#endif /* WOLFSSL_ASN_CA_ISSUER */

int wolfSSL_X509_check_issued(WOLFSSL_X509 *issuer, WOLFSSL_X509 *subject)
{
Expand Down
Loading