CertificateValidationContext crl setting cannot be used in combination with an intermediate CA trust anchor

Title: CertificateValidationContext crl setting cannot be used in combination with an intermediate CA trust anchor

Description: When configuring a CertificateValidationContext with an intermediate CA in the trusted_ca setting, adding a CRL issued by that intermediate CA causes all certificates issued by that CA to be rejected.

This appears similar to https://github.com/openssl/openssl/issues/5081.

The documentation does state:

Note that if a CRL is provided for any certificate authority in a trust chain, a CRL must be provided for all certificate authorities in that chain.

However, in this scenario a CRL is provided for all certificate authorities in the chain (as the root CA is not part of the trust chain), and even if I include a CRL issued by the root CA, I see the same error.

Repro steps:

Configuration and test files are available in crl-intermediate.tar.gz.

1. Run Envoy with the provided configuration (also listed below in the Config section):

docker run --rm -it -p 9901:9901 -p 10000:10000 -v .:/certs:ro envoyproxy/envoy:v1.27-latest -c certs/envoy.yaml

2. Attempt to access the configured route, providing a non-revoked client certificate/key:

$ curl --cacert server.cert.pem --cert client.cert.pem --key client.key.pem https://localhost:10000/
curl: (56) LibreSSL SSL_read: error:1404C418:SSL routines:ST_OK:tlsv1 alert unknown ca, errno 0

Admin and Stats Output:

• /stats
• /clusters
• /routes (this endpoint serves a 404)
• /server_info

Config:

This is the same as the envoy-demo.yaml file, but with a TLS transport_socket added to the filter chain:

static_resources:

  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          access_log:
          - name: envoy.access_loggers.stdout
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                route:
                  host_rewrite_literal: www.envoyproxy.io
                  cluster: service_envoyproxy_io
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
          require_client_certificate: true
          common_tls_context:
            tls_certificates:
            - certificate_chain:
                filename: certs/server.cert.pem
              private_key:
                filename: certs/server.key.pem
            validation_context:
              crl:
                filename: certs/intermediate.crl.pem
              trusted_ca:
                filename: certs/intermediate-ca.cert.pem

  clusters:
  - name: service_envoyproxy_io
    type: LOGICAL_DNS
    # Comment out the following line to test on v6 networks
    dns_lookup_family: V4_ONLY
    load_assignment:
      cluster_name: service_envoyproxy_io
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: www.envoyproxy.io
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: www.envoyproxy.io

Logs:

[2023-08-22 20:01:30.684][19][debug][conn_handler] [source/extensions/listener_managers/listener_manager/active_tcp_listener.cc:157] [Tags: "ConnectionId":"1"] new connection from 172.17.0.1:48252 [2023-08-22 20:01:30.691][19][debug][connection] [source/extensions/transport_sockets/tls/cert_validator/default_validator.cc:323] verify cert failed: X509_verify_cert: certificate verification error at depth 1: unable to get certificate CRL [2023-08-22 20:01:30.691][19][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:373] [Tags: "ConnectionId":"1"] Async cert validation completed [2023-08-22 20:01:30.691][19][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:247] [Tags: "ConnectionId":"1"] remote address:172.17.0.1:48252,TLS error: 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED [2023-08-22 20:01:30.691][19][debug][connection] [source/common/network/connection_impl.cc:250] [Tags: "ConnectionId":"1"] closing socket: 0 [2023-08-22 20:01:30.691][19][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:247] [Tags: "ConnectionId":"1"] remote address:172.17.0.1:48252,TLS error: 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED [2023-08-22 20:01:30.691][19][debug][conn_handler] [source/extensions/listener_managers/listener_manager/active_stream_listener_base.cc:121] [Tags: "ConnectionId":"1"] adding to cleanup list

Call Stack: n/a