In article <[EMAIL PROTECTED]> you wrote:
> when revoke a certificate '01.pem' ,and use
> 'openssl ca -gencrl -out crl.pem'
> to generate crl . then 'cat crl.pem >>./demoCA/cacert.pem',
>
> when use 'openssl verify -CApath ./demoCA
> -CAfile ./demoCA/cacert.pem 01.pem' to verify the
> revoked certificate 01.pem ,the result is OK.
> i gdb the verify ,and find that crl has not been used.
>
> how can i use crl correctly?
AFAIK the default verify stuff in OpenSSL doesn't take CRLs into account, so
the "openssl verify" command fails here. Currently the only way to verify
CRLs is to write an own verify callback routine which does it.
Ralf S. Engelschall
[EMAIL PROTECTED]
www.engelschall.com
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
