On Tue, Aug 30, 2011 at 10:49:04PM -0500, Raphael Geissert wrote: > On Tuesday 30 August 2011 15:48:11 Mike Hommey wrote: > > On Tue, Aug 30, 2011 at 09:58:18PM +0200, Yves-Alexis Perez wrote: > > > On mar., 2011-08-30 at 12:29 -0500, Raphael Geissert wrote: > > > > What I can't tell for sure from the documentation is whether OpenSSL > > > > and GnuTLS do check the CRL's validity (signature and time.) It > > > > doesn't seem like they do. > > > > This is relevant if we were to ship them in ca-certificates. > > Mike, without digging into the documentation I found this reference [2] > regarding NSS and its CRL support. Do you know if any of what is said on that > email has changed? namely how 'next update' dates are handled. > > [2]http://www.mail-archive.com/mozilla-crypto@mozilla.org/msg00890.html
I think CRL handling is still mostly manual work. I don't know much more though. Mike -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
