node-opcua / node-opcua-pki / 37072564416

92%

push

github

fix(certificate-manager): revocation is read in the issuer's own CRLs; an accepted outdated issuer passes

isCertificateRevoked also looked the serial number up in the trusted
CRL of the CA above the issuer. Serial numbers are per CA, so a leaf
sharing one with a certificate the root had revoked was reported
revoked. It now reads every CRL of the issuer, from both stores, and
no other CA's.

With acceptOutDatedIssuerCertificate, an expired issuing CA still ended
in BadSecurityChecksFailed. It is now accepted; without the option it
is refused as BadCertificateIssuerTimeInvalid as before, and the option
does not make an untrusted chain trusted.

716 of 929 branches covered (77.07%)

8 of 8 new or added lines in 1 file covered. (100.0%)

1936 of 2112 relevant lines covered (91.67%)

551.94 hits per line