[tnytown]

Here's a tranche of CRL testcases as outlined in pyca/cryptography#10393 (comment):

• CRL with invalid signature
• CRL signed by incorrect private key
• Empty CRL (no revoked certificates)
• Very large CRL (performance test)
• CRL with unknown critical extension
• CRL with unknown non-critical extension
• CRL with duplicate revoked entry serial numbers

• CRL entry with unknown critical extension
• CRL entry with unknown non-critical extension

[tnytown]

For most of these tests, I had to be careful not to conflate a failure to interpret the CRL and a failure to build the chain. Consider a CRL containing an uninterpretable critical extension and an entry revoking the leaf certificate. For this case, a conformant verifier would fail because the CRL is invalid, while a non-conformant verifier would fail to build the chain as it interprets the CRL and revokes the certificate. I worked around this for these tests, but there may be something we can do in limbo to better support verifying CRL validation behavior.

[tnytown]

@woodruffw can I get a review on this when you're available? i think the regression check is failing because it's a PR from a fork.

[nbastin]

These look generally OK to me, but I just wanted to jump in here to say that "CRL with duplicate revoked entry serial numbers" should be slotted into RFC5280 tests, as this is completely valid (and intentionally used) in non-RFC5280 X.509 PKI profiles.

[nbastin]

Also, and maybe I'm just not interpreting the test cases properly, but the descriptions for extensions don't make clear whether the test is about crlExtensions at the top level, or about crlEntryExtensions inside revokedCertificates.

[tnytown]

Also, and maybe I'm just not interpreting the test cases properly, but the descriptions for extensions don't make clear whether the test is about crlExtensions at the top level, or about crlEntryExtensions inside revokedCertificates.

Only the last two tests are applicable to crlEntryExtensions (hence the "CRL entry" verbiage) whereas the other extension tests are for crlExtensions; I can reword the descriptions for the latter to reflect that they apply to the top-level extensions.

[woodruffw]

This seems fine, but maybe it can be extra_extensions for generality?

[tnytown]

agree! we'll have to change the identical surface in the cert builders as well; probably deserves a separate PR

[woodruffw]

Thank you @tnytown!