使用HTTP获取CRL时OpenSSL证书验证失败，本地验证正常

使用本地CRL文件验证证书完全正常，但通过HTTP访问同一CRL文件进行验证时失败。无论Apache2返回的Content-Type设为application/pem-certificate-chain还是text/plain，结果一致。不确定问题出在Apache配置（具体哪项？）还是OpenSSL特性/错误，求解决思路。

本地验证成功记录 #

本地直接指定CRL文件验证，单CRL和多CRL场景都能通过：

root@pkibox:~/simki# openssl verify -CAfile certs/za-fullchain.crt -crl_check -CRLfile crl/crl-a1.pem certs/za.crt
certs/za.crt: OK
root@pkibox:~/simki# openssl verify -CAfile certs/za-fullchain.crt -crl_check_all -CRLfile crl/crl-a1.pem -CRLfile crl/crl-r1.pem certs/za.crt
certs/za.crt: OK

HTTP验证失败日志 #

使用-crl_download参数让OpenSSL自动从证书的CRL URI下载验证时，返回错误：

root@pkibox:~/simki# openssl verify -CAfile certs/za-fullchain.crt -crl_check -crl_download certs/za.crt
Unable to load CRL via CDP
802B4BD0EF7F0000:error:1E80006E:HTTP routines:OSSL_HTTP_REQ_CTX_nbio:missing asn1 encoding:../crypto/http/http_client.c:755:
802B4BD0EF7F0000:error:1E800067:HTTP routines:OSSL_HTTP_REQ_CTX_exchange:error receiving:../crypto/http/http_client.c:874:server=http://pki.xxx.net:80
O = SIM, OU = SIM NOC, CN = za
error 3 at 0 depth lookup: unable to get certificate CRL
error certs/za.crt: verification failed

Apache访问日志确认 #

Apache日志显示OpenSSL确实发起了CRL文件的请求，且返回200状态：

pki.xxx.net:80 192.168.255.5 - - [17/Apr/2023:06:24:02 +0000] "GET /crl-a1.pem HTTP/1.0" 200 918 "-" "-"

cURL测试结果 #

用cURL能正常获取CRL文件，内容完整：

root@pkibox:~/simki# curl -v http://pki.xxx.net/crl-a1.pem
*   Trying 192.168.255.5:80...
* Connected to pki.xxx.net (192.168.255.5) port 80 (#0)
> GET /crl-a1.pem HTTP/1.1
> Host: pki.xxx.net
> User-Agent: curl/7.81.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Mon, 17 Apr 2023 06:23:58 GMT
< Server: Apache/2.4.52 (Ubuntu)
< Last-Modified: Mon, 17 Apr 2023 06:18:28 GMT
< ETag: "286-5f98228c77597"
< Accept-Ranges: bytes
< Content-Length: 646
< Content-Type: application/pem-certificate-chain
<
-----BEGIN X509 CRL-----
MIIBszCBnAIBATANBgkqhkiG9w0BAQsFADA5MQwwCgYDVQQKDANSSU0xEDAOBgNV
BAsMB1JJTSBOT0MxFzAVBgNVBAMMDlJJTSBTaWduaW5nIEExFw0yMzA0MTcwNjE3
[ ... ]
nBLzoS7VkQ==
-----END X509 CRL-----
* Connection #0 to host pki.xxx.net left intact

证书CRL URI确认 #

证书包含正确的CRL分发点URI：

root@pkibox:~/simki# openssl x509 -in certs/za.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        [ ... ]
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            [ ... ]
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.xxx.net/crl-a1.pem
    [ ... ]

CRL文件信息 #

本地CRL文件格式合法，内容正常：

root@pkibox:~/simki# openssl crl -in /var/www/simki/crl-a1.pem -noout -text
Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = SIM, OU = SIM NOC, CN = SIM Signing A1
        Last Update: Apr 17 06:17:27 2023 GMT
        Next Update: Apr 16 06:17:27 2024 GMT
        CRL extensions:
            X509v3 Authority Key Identifier:
                6E:5B:C0:D1:03:41:D2:65:49:89:47:F9:D4:48:D5:5E:68:A8:F4:6F
            X509v3 CRL Number:
                1
No Revoked Certificates.
    Signature Algorithm: sha256WithRSAEncryption
[ ... ]

解决思路 #

• 检查HTTP传输的CRL是否存在额外内容：OpenSSL对CRL格式要求严格，对比本地CRL和HTTP获取的CRL的二进制内容，用hexdump -C查看是否有多余的换行、空格或BOM头：

  # 本地文件
  hexdump -C crl/crl-a1.pem > local_crl.txt
  # HTTP获取的文件
  curl http://pki.xxx.net/crl-a1.pem | hexdump -C > remote_crl.txt
  # 对比差异
  diff local_crl.txt remote_crl.txt
  

• 禁用Apache的Chunked编码和压缩：部分OpenSSL版本无法正确处理Chunked编码的响应，在CRL文件所在目录的Apache配置中添加：

  <FilesMatch "\.pem$">
      SetEnv no-gzip 1
      SetEnv dont-vary 1
      Header unset Transfer-Encoding
  </FilesMatch>
  

  重启Apache后重新测试。
• 尝试提供DER格式的CRL：OpenSSL的HTTP下载可能优先支持DER二进制格式，生成DER格式CRL并修改配置：

  # 生成DER格式CRL
  openssl crl -in crl/crl-a1.pem -out /var/www/simki/crl-a1.der -outform DER
  

  修改证书的CRL URI为http://pki.xxx.net/crl-a1.der，并在Apache中设置对应Content-Type：

  <FilesMatch "\.der$">
      ForceType application/x-x509-crl
  </FilesMatch>
  

• 启用OpenSSL调试日志：通过调试日志查看HTTP交互细节，定位解析失败原因：

  OPENSSL_DEBUG_LEVEL=3 openssl verify -CAfile certs/za-fullchain.crt -crl_check -crl_download certs/za.crt
  

• 检查OpenSSL版本：升级到较新版本的OpenSSL（如1.1.1t及以上），修复旧版本可能存在的HTTP客户端bug。

内容的提问来源于stack exchange，提问作者Volodymyr Litovka