Add OCSP and CRL support to certificate verify

Add args and functionality to certificate verify to check a CRL
and OCSP for a certificate based on the extensions. Users can pass
flags to enable verification of each (CRL, OCSP). The command will try
and get the CRL and OCSP server from the certifiacate and verify the
certificate against each.

I also moved functions from the crl command into internal/crlutil
package so they can be re-used with the certificate verify command.

Implements #845

Author: redrac

command/certificate/verify.go

@@ -1,15 +1,22 @@
 package certificate
 
 import (
+	"bytes"
 	"crypto/x509"
 	"encoding/pem"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
 	"os"
 
 	"github.com/pkg/errors"
 	"github.com/smallstep/cli/flags"
+	"github.com/smallstep/cli/internal/crlutil"
 	"github.com/urfave/cli"
 	"go.step.sm/cli-utils/errs"
 	"go.step.sm/crypto/x509util"
+	"golang.org/x/crypto/ocsp"
 )
 
 func verifyCommand() cli.Command {
@@ -18,7 +25,10 @@ func verifyCommand() cli.Command {
 		Action: cli.ActionFunc(verifyAction),
 		Usage:  `verify a certificate`,
 		UsageText: `**step certificate verify** <crt-file> [**--host**=<host>]
-[**--roots**=<root-bundle>] [**--servername**=<servername>]`,
+[**--roots**=<root-bundle>] [**--servername**=<servername>]
+[**--ca**]=file [**--verify-verbose**]
+[**--verify-ocsp**]] [**--ocsp-endpoint**]=url
+[**--verify-crl**] [**--crl-endpoint**]=url`,
 		Description: `**step certificate verify** executes the certificate path
 validation algorithm for x.509 certificates defined in RFC 5280. If the
 certificate is valid this command will return '0'. If validation fails, or if
@@ -65,7 +75,24 @@ Verify a certificate using a custom directory of root certificates for path vali
 '''
 $ step certificate verify ./certificate.crt --roots ./root-certificates/
 '''
-`,
+
+Verify a certificate including OCSP and CRL using CRL and OCSP defined in the certificate
+
+'''
+$ step certificate verify ./certificate.crt --ca ./issuing_ca.pem  --verify-crl --verify-ocsp
+'''
+
+Verify a certificate including OCSP and specificing an OCSP server
+
+'''
+$ step certificate verify ./certificate.crt --ca ./issuing_ca.pem  --verify-ocsp --ocsp-endpoint http://acme.com/ocsp
+'''
+
+Verify a certificate including CRL and specificing a CRL server
+
+'''
+$ step certificate verify ./certificate.crt --ca ./issuing_ca.pem  --verify-crl --crl-endpoint http://acme.com/crl
+'''`,
 		Flags: []cli.Flag{
 			cli.StringFlag{
 				Name:  "host",
@@ -87,7 +114,32 @@ authenticity of the remote server.
     **directory**
 	:  Relative or full path to a directory. Every PEM encoded certificate from each file in the directory will be used for path validation.`,
 			},
+			cli.StringFlag{
+				Name:  "ca",
+				Usage: `The certificate issuer CA <file> needed to communicate with OCSP and verify a CRL.`,
+			},
+			cli.BoolFlag{
+				Name:  "verify-ocsp",
+				Usage: "Verify the certificate against it's OCSP.",
+			},
+			cli.StringFlag{
+				Name:  "ocsp-endpoint",
+				Usage: `The OCSP endpoint to use. If not provided step will attempt to check it against the certificate's OCSPServer AIA extension endpoints.`,
+			},
+			cli.BoolFlag{
+				Name:  "verify-crl",
+				Usage: "Verify the certificate against it's CRL.",
+			},
+			cli.StringFlag{
+				Name:  "crl-endpoint",
+				Usage: "The CRL endpoint to use. If not provided step will attempt to check it against the certificate's CRLDistributionPoints extension endpoints.",
+			},
+			cli.BoolFlag{
+				Name:  "verify-verbose",
+				Usage: "Print result of certificate verification to stdout on success",
+			},
 			flags.ServerName,
+			flags.Insecure,
 		},
 	}
 }
@@ -102,11 +154,23 @@ func verifyAction(ctx *cli.Context) error {
 		host             = ctx.String("host")
 		serverName       = ctx.String("servername")
 		roots            = ctx.String("roots")
+		verifyOCSP       = ctx.Bool("verify-ocsp")
+		ocspEndpoint     = ctx.String("ocsp-endpoint")
+		verifyCRL        = ctx.Bool("verify-crl")
+		crlEndpoint      = ctx.String("crl-endpoint")
+		verbose          = ctx.Bool("verify-verbose")
+		issuerFile       = ctx.String("ca")
+		insecure         = ctx.Bool("insecure")
 		intermediatePool = x509.NewCertPool()
 		rootPool         *x509.CertPool
 		cert             *x509.Certificate
+		issuer           *x509.Certificate
 	)
 
+	if issuerFile == "" && verifyOCSP {
+		return errors.Errorf("You must provide the issuinge CA certificate if you want to verify the certificate with OCSP")
+	}
+
 	switch addr, isURL, err := trimURL(crtFile); {
 	case err != nil:
 		return err
@@ -180,5 +244,127 @@ func verifyAction(ctx *cli.Context) error {
 		return errors.Wrapf(err, "failed to verify certificate")
 	}
 
+	verboseMSG := "certificate validated against roots\n"
+	if host != "" {
+		verboseMSG = verboseMSG + "certificate host name validated\n"
+	}
+
+	if issuerFile != "" {
+		issuerCertPEM, err := ioutil.ReadFile(issuerFile)
+		if err != nil {
+			return errors.Errorf("unable to load the issuing CA certificate file")
+		}
+
+		issuerBlock, _ := pem.Decode(issuerCertPEM)
+		if issuerBlock == nil || issuerBlock.Type != "CERTIFICATE" {
+			return errors.Errorf("failed to decode the issuing CA certificate")
+		}
+
+		issuer, err = x509.ParseCertificate(issuerBlock.Bytes)
+		if err != nil {
+			return errors.Errorf("failed to parse the issuing CA certificate")
+		}
+	}
+
+	if verifyCRL {
+		var endpoint string
+		if crlEndpoint != "" && issuer.Equal(&x509.Certificate{}) {
+			return errors.Errorf("you must provider the issuer CA if you are going to specificy the CRL endpoint")
+		} else if crlEndpoint != "" {
+			endpoint = crlEndpoint
+		} else if len(cert.CRLDistributionPoints) == 0 {
+			return errors.Errorf("CRL distribution endpoint not found in certificate")
+		} else {
+			endpoint = cert.CRLDistributionPoints[0]
+		}
+
+		httpClient := http.Client{}
+
+		resp, err := httpClient.Get(endpoint)
+		if err != nil {
+			return errors.Wrap(err, "error downloading crl")
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode >= 400 {
+			return errors.Errorf("error downloading crl: status code %d", resp.StatusCode)
+		}
+		b, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return errors.Wrap(err, "error downloading crl")
+		}
+
+		crl, err := x509.ParseRevocationList(b)
+		if err != nil {
+			return errors.Wrap(err, "error parsing crl")
+		}
+
+		crlJson, err := crlutil.ParseCRL(b)
+		if err != nil {
+			return errors.Wrap(err, "error parsing crl into json")
+		}
+
+		if !issuer.Equal(&x509.Certificate{}) && !insecure {
+			err = crl.CheckSignatureFrom(issuer)
+			if err != nil {
+				return errors.Wrap(err, "error validating the CRL against the CA issuer")
+			}
+		}
+
+		for _, revoked := range crlJson.RevokedCertificates {
+			if cert.SerialNumber.String() == revoked.SerialNumber {
+				return errors.Errorf("certificate marked as revoked in CRL %s", endpoint)
+			}
+		}
+		verboseMSG = verboseMSG + fmt.Sprintf("certificate not revoked in CRL %s\n", endpoint)
+	}
+
+	if verifyOCSP {
+		var endpoint string
+		if ocspEndpoint != "" {
+			endpoint = ocspEndpoint
+		} else if len(cert.OCSPServer) == 0 {
+			return errors.Errorf("no OCSP AIA extension found")
+		} else {
+			endpoint = cert.OCSPServer[0]
+		}
+
+		req, err := ocsp.CreateRequest(cert, issuer, nil)
+		if err != nil {
+			return errors.Errorf("error creating OCSP request")
+		}
+
+		httpReq, err := http.NewRequest(http.MethodPost, endpoint, bytes.NewReader(req))
+		if err != nil {
+			return errors.Errorf("error contacting OCSP server: %s", endpoint)
+		}
+		httpReq.Header.Add("Content-Type", "application/ocsp-request")
+		httpResp, err := http.DefaultClient.Do(httpReq)
+		if err != nil {
+			return errors.Errorf("error contacting OCSP server: %s", endpoint)
+		}
+		defer httpResp.Body.Close()
+		respBytes, err := ioutil.ReadAll(httpResp.Body)
+		if err != nil {
+			return errors.Errorf("error reading response from OCSP server: %s", endpoint)
+		}
+
+		resp, err := ocsp.ParseResponse(respBytes, issuer)
+		if err != nil {
+			return errors.Errorf("error parsing repsonse from OCSP server: %s", endpoint)
+		}
+
+		switch resp.Status {
+		case ocsp.Revoked:
+			return errors.Errorf("certificate has been revoked according to OCSP %s", endpoint)
+		case ocsp.Good:
+		default:
+			return errors.Errorf("certificate status is unknown according to OCSP %s", endpoint)
+		}
+		verboseMSG = verboseMSG + fmt.Sprintf("certificate status shows good in OCSP\n", endpoint)
+	}
+
+	if verbose {
+		fmt.Println(verboseMSG + "certficiate is valid")
+	}
 	return nil
 }