tls: crl option only loads first CRL from concatenated PEM bundle

[zenonhun]

Version

Affects all current versions (tested on v22.x). The bug has been present since the initial implementation.

Platform

All platforms (the issue is in the C++ TLS layer).

Subsystem

tls, crypto

What steps will reproduce the bug?

When passing a PEM file containing multiple concatenated CRLs to the crl option of tls.createSecureContext() (or https.Agent, tls.connect, etc.), only the first CRL in the PEM bundle is loaded. Subsequent
CRLs are silently ignored.

This causes UNABLE_TO_GET_CRL errors when verifying certificate chains where different certificates are signed by different CAs, each with their own CRL.

Minimal reproducer:

  const tls = require('node:tls');
  const https = require('node:https');

  // A PEM file containing two concatenated CRLs:
  // - CRL for Intermediate CA
  // - CRL for Root CA
  const crlBundle = `-----BEGIN X509 CRL-----
  <intermediate CA CRL>
  -----END X509 CRL-----
  -----BEGIN X509 CRL-----
  <root CA CRL>
  -----END X509 CRL-----`;

  const agent = new https.Agent({
    ca: caCertBundle,     // works fine with concatenated PEM
    crl: crlBundle,       // BUG: only the first CRL is loaded
    rejectUnauthorized: true,
  });

  // This fails with: Error: unable to get certificate CRL
  // because the second CRL (root CA) was never loaded into the X509_STORE.
  const res = await fetch('https://example.com', { dispatcher: agent });

Swapping the order of the two CRLs in the PEM bundle changes which CRL is loaded, confirming only the first entry is parsed.

How often does it reproduce? Is there a required condition?

100% reproducible. The only required condition is that the crl option is a PEM string (or Buffer) containing more than one CRL. If the bundle contains only one CRL, the bug is not observable.

What is the expected behavior? Why is that the expected behavior?

All CRLs in a concatenated PEM bundle should be loaded, matching the behavior of the ca option which correctly handles concatenated PEM bundles containing multiple CA certificates.

What do you see instead?

Only the first CRL from the PEM bundle is loaded. Verification fails with UNABLE_TO_GET_CRL for any certificate in the chain whose issuer's CRL was not the first entry in the bundle.

Root cause

In src/crypto/crypto_tls_certificates.cc (https://github.com/nodejs/node/blob/main/src/crypto/crypto_tls_certificates.cc), the AddCRL function calls PEM_read_bio_X509_CRL once and returns:

  bool AddCRL(Environment* env,
              SSL_CTX* ctx,
              const ncrypto::BIOPointer& bio,
              X509_STORE** cache) {
    if (!bio) return false;

    DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
        PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
    if (!crl) return false;

    X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
    CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
    CHECK_EQ(1,
             X509_STORE_set_flags(
                 cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
    return true;
  }

OpenSSL's PEM_read_bio_X509_CRL reads a single PEM block from the BIO and advances the read position. To read all CRLs, the caller must loop until it returns NULL. This is documented in PEM_read(3)
(https://docs.openssl.org/master/man3/PEM_read/) and is how IMPLEMENT_PEM_read_bio works internally.

The adjacent AddCACertificates function in the same file does this correctly:

  size_t AddCACertificates(Environment* env,
                           SSL_CTX* ctx,
                           const ncrypto::BIOPointer& bio,
                           X509_STORE** cache) {
    if (!bio) return 0;

    size_t count = 0;
    while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
               bio.get(), nullptr, NoPasswordCallback, nullptr))) {
      CHECK_EQ(1,
               X509_STORE_add_cert(GetOrCreateOwnedCertStore(env, ctx, cache),
                                   x509.get()));
      CHECK_EQ(1, SSL_CTX_add_client_CA(ctx, x509.get()));
      count++;
    }
    return count;
  }

Additional information

• curl --crlfile with the same concatenated PEM bundle works correctly (it loops over all CRLs)
• The ca option in Node.js handles concatenated PEM bundles correctly (via the while loop in AddCACertificates)
• The bug has been present since at least 2013 based on git history of the AddCRL function