openssl/openssl

The handling of the CRL Number field by OpenSSL

Open

#27,085 opened on Mar 18, 2025

View on GitHub
 (2 comments) (0 reactions) (0 assignees)C (11,262 forks)batch import
branch: masterhelp wantedtriaged: feature

Repository metrics

Stars
 (30,157 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Version: OpenSSL 3.4.1 11 Feb 2025 (Library: OpenSSL 3.4.1 11 Feb 2025)

Describtion: Hello Developer, I have a CRL file with a CRL Number value of -36. According to RFC5280, the CRL Number value should be a non-negative integer, but OpenSSL successfully printed this CRL without any errors.

Command: openssl crl -inform DER -in crl_file_test_.der -text

Test case:

crl_file_test_.zip

Contributor guide

Research direction
Locate the CRL parsing code in OpenSSL, specifically the function that handles the CRL number extension. Check if it properly validates that the number is non negative as per RFC5280. Add a check to reject negative values.
Tech stack
c
Domain
securitybackend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60