Security issue notifications

If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.

Problem:

Currently, s2n-tls does not support certificate revocation validation via CRLs.

Solution:

Implement a callback that will allow users to provide CRLs for received certificates, which will be used to check the certificates for revocation.

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? Yes, new public APIs will be added to set and interact with the CRL callback.
• Which versions of TLS will this impact? All versions.

Project Plan

• Add test certificate chains and CRLs for testing CRL validation #3458
• Return s2n_result from x509 validator functions #3444
• Refactor s2n_x509_validator_validate_cert_chain to support an async callback #3500
• Add wrapper struct for X509_CRL #3520
• Refactor write_pem_file_to_stuffer_as_chain #3553
• Add array init with capacity API #3554
• Add CRL lookup callback #3546
• Move CRL timestamp validation into the CRL lookup callback #3515
• Add and document CRL APIs #3523

Other potential features

• CRL cache
• Enable CRL validation for only leaf certificates #3584