On Thu, Sep 24, 2026 at 08:47:17AM +0200, Theo Buehler wrote:
> On Sat, Sep 12, 2026 at 12:55:04AM +0000, Job Snijders wrote:
> > RFC 6480 section 4.2 figure 2 shows that all valid products in the same
> > CA repository (i.e., listed on the same manifest) point to the same CRL.
> > 
> > Already today rpki-client checks whether the CRLDP in a given Manifest
> > EE certificate aligns with the CRL location derived from the fileList
> > (see mft.c lines 193-197). This diff adds a similar check to verify
> > alignment of the CRLDP in CA certificates, BGPsec certs, and the EE
> > certs in other signed objects.
> 
> We have only done this for CA and BGPsec certs for now. In order not to
> introduce further complications with deduplication efforts, I think the
> correct placement for this check is at the end of valid_x509() at which
> point we know we have a CRL (due to passing X509_V_FLAG_CRL_CHECK).
> 
> Here's a first, trivial refactoring step towards this goal. The second
> step will add the strcmp(). Subsequent steps will deal with valid_cert()
> and the somewhat unfortunate naming.

OK job@