[Bug]: WolfSSL accepts a certificate whose serial number is zero #8615
Description
Contact Details
Version
WolfSSL 5.6.4
Description
./configure
make
sudo make install
./testsuite/testsuite.test
wolfSSL is configured and built by default
Reproduction steps
// gcc -g verify.c -o verify -lwolfssl
// gcc -g verify.c -o verify -lwolfssl
#include <stdlib.h>
#include <wolfssl/ssl.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
int wolfSSL_Verify_PEM(char * cac, char * ec){
int ret = 0;
// to create a new wolfSSL cert manager
WOLFSSL_CERT_MANAGER* cm;
cm = wolfSSL_CertManagerNew();
if (cm == NULL){
printf("Creating a new wolfSSL_CertManager failed!\n");
exit(1);
}
// to load cac to the created wolfSSL_CertManager
ret = wolfSSL_CertManagerLoadCA(cm, cac, NULL);
if (ret != SSL_SUCCESS){
printf("Loading cac to the created wolfSSL_CertManager failed!\n");
exit(2);
}
// to verify the ec in the created wolfSSL_CertManager
ret = wolfSSL_CertManagerVerify(cm, ec, SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS){
printf("wolfSSL_CertManagerVerify filed and with return code %d and error message %s\n",
ret,
wolfSSL_ERR_reason_error_string(ret));
}
else{
printf("The target cert has passed through verification.\n");
}
// to free cm
wolfSSL_CertManagerFree(cm);
return ret;
}
int main(int argc, char ** argv){
char * cac = argv[1];
char * ec = argv[2];
wolfSSL_Verify_PEM(cac, ec);
return 0;
}
Actual result:
The target cert has passed through verification.
WolfSSL accepts a certificate whose serial number is zero which is forbidden by RFC 5280 and its errata. The certificate should be rejected according to Sec. 4.1.2.2 in RFC 5280 "The serial number MUST be a positive integer assigned by the CA to each certificate" and the errata #3200 "The serial number MUST be a positive non-zero integer assigned by the CA to each certificate".
OpenSSL:
openssl verify -CAfile ca.pem 14.pem
14.pem：OK
GnuTLS:
certtool --verify --load-ca-certificate=ca.pem < 14.pem
Chain verification output: Verified. The certificate is trusted.
I provided this test certificate: