RAT: Retrieval-Augmented Testing of Certificate Revocation List Parsers in TLS Implementations

Transport Layer Security (TLS) implementations form the backbone of countless software systems, spanning web browsers, email clients, cloud services, and Internet of Things software, by enabling secure authentication and encrypted communication. However, their reliability hinges on the integrity of components like the Certificate Revocation List (CRL), which revokes compromised certificates to prevent attackers from exploiting expired or unauthorized credentials. Despite the CRL's critical role, CRL parsers, which decode CRL data for validation, remain overlooked in security research, exposing TLS-dependent software to potential threats. To address this gap, we introduce Retrieval-Augmented Testing (RAT), a framework powered by Large Language Models (LLMs), to systematically evaluate CRL parsers in mainstream TLS implementations such as OpenSSL, GnuTLS, and wolfSSL. RAT begins with leveraging an LLM to retrieve historical bug reports and cross-reference them with Request for Comments (RFC) 5280 specifications, generating structured test cases via an Abstract Syntax Notation One-aware mutation engine. These test cases are then fed into CRL parsers, and RAT employs an LLM to normalize their outputs. By analyzing these normalized results, RAT detects discrepancies and uncovers latent risks in CRL parsers. Our work makes the following contributions: (1) Unlike prior work focusing on certificate validation, this is the first study to systematically assess CRL parsers; (2) We propose RAT, a novel testing framework that leverages an LLM to integrate insights from retrieved bug reports and RFC 5280, enabling automated test-case generation; and (3) We have implemented an open-source prototype of RAT and experiments uncovered 23 new bugs, features, enhancements, fixes in commits, and x509s, demonstrating RAT's potential to strengthen the reliability and security of CRL parsers in TLS implementations.