From 1e303a5014a6043974d4cb817a2aa059ce12ed84 Mon Sep 17 00:00:00 2001 From: "shuwen.wu" Date: Wed, 2 Sep 2026 19:35:21 +0800 Subject: [PATCH] crypto, tls: support PEM CRL bundle in addCRL() Fix issue #65576 where addCRL() only loads the first CRL from a concatenated PEM bundle. The AddCACertificates() function already correctly handles concatenated PEM using a while loop, so migrate the same pattern to AddCRL(). PR-URL: https://github.com/nodejs/node/pull/65577 Reviewed-By: Assisted-by: TRAE agent --- src/crypto/crypto_tls_certificates.cc | 10 +++++----- src/crypto/crypto_tls_certificates.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/crypto/crypto_tls_certificates.cc b/src/crypto/crypto_tls_certificates.cc index ace1d41aefec..e2094a1abe63 100644 --- a/src/crypto/crypto_tls_certificates.cc +++ b/src/crypto/crypto_tls_certificates.cc @@ -57,12 +57,12 @@ bool AddCRL(Environment* env, X509_STORE** cache) { if (!bio) return false; - DeleteFnPtr crl( - PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr)); - if (!crl) return false; - X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache); - CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get())); + while (X509_CRL* crl_raw = + PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr)) { + DeleteFnPtr crl(crl_raw); + CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get())); + } CHECK_EQ(1, X509_STORE_set_flags( cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL)); diff --git a/src/crypto/crypto_tls_certificates.h b/src/crypto/crypto_tls_certificates.h index e36a583e6d4b..058d5a18a832 100644 --- a/src/crypto/crypto_tls_certificates.h +++ b/src/crypto/crypto_tls_certificates.h @@ -30,7 +30,7 @@ size_t AddCACertificates(Environment* env, const ncrypto::BIOPointer& bio, X509_STORE** cache = nullptr); -// Add one PEM CRL and enable CRL checking. +// Add PEM CRL(s) and enable CRL checking. bool AddCRL(Environment* env, SSL_CTX* ctx, const ncrypto::BIOPointer& bio,