Implement Certificate.load to load certificate chain.

[ioquatix]

Follow up to #361

[ioquatix]

I'm not sure error handling is right. If we have a broken DER certificate, do we get to EOF?

[ioquatix]

There is no easy result from the PEM or DER parser which seems to indicate: "I reached the end of file there are no more certificates."

[rhenium]

Do we need to support concatenated DER? I've never seen it's used somewhere.

[ioquatix]

@rhenium I agree, so I'm changing it.

[ioquatix]

In order to parse DER first, we have to ignore some error of DER when trying to parse PEM format, specifically:

        /* If we cannot read one certificate because we could not read the DER encoding: */
        if (ERR_GET_REASON(ERR_peek_last_error()) == ERR_R_NESTED_ASN1_ERROR) {
            ossl_clear_error();
        }

Is this acceptable?

[ioquatix]

@rhenium do you know why this fails on Windows with the pure Ruby load_file?

[rhenium]

In order to parse DER first, we have to ignore some error of DER when trying to parse PEM format, specifically:

        /* If we cannot read one certificate because we could not read the DER encoding: */
        if (ERR_GET_REASON(ERR_peek_last_error()) == ERR_R_NESTED_ASN1_ERROR) {
            ossl_clear_error();
        }

Is this acceptable?

Argh. No, this will not work because parsing random data (PEM-encoding) as DER-encoding can fail in other ways, too.

I don't think there is a direct way to check that the failure is from DER parsing (and not from malloc() or somewhere else).

I'm not sure if there is another way except for falling back to PEM parsing on any kind of error.

[rhenium]

@rhenium do you know why this fails on Windows with the pure Ruby load_file?

I guess it's CRLF conversion... I think it should've used File.binread.

[rhenium]

I disagree with the change in ext/openssl/ossl_bio.c, but apart from that and two fix-ups I commented in-line, it looks good to me.

[ioquatix]

Okay, all your feedback was addressed as you requested.

[rhenium]

Okay, all your feedback was addressed as you requested.

Yes, it was already ready for merge. Thank you for working on this!

[ioquatix]

@rhenium thanks for your multiple detailed reviews and feedback, the PR was much better because of your time and effort.