Hello, OpenSSL doesn't cleanly verify revocation status when a CA is renewed (with a key change). Attached is a proposed patch to handle this case. This patch has been done against the current CVS version (I mirror it every night).
For a description of the problem, please consider the following situation: * a CA (name it "CN=My Trusted CA" for example) is created, delivers certificates, revokes some, and periodically generates CRLs * this CA will expire in 1 year, so for service continuity (end-users certificates have a 1-year validity period), it has to be renewed * a new keypair is generated, a new certificate for this CA is produced (we *MUST* keep the same name to make it be the same CA) * this new CA certificate is deployed across the end-users base, and now this new generation CA does the job: certificate generation, revocation, CRL signing, etc), and the end-user certificates previously revoked by the old generation CA will be present in the CRL produced by this new generation CA So the only CRL to have is the new one (the old generation CA doesn't sign anything anymore). OpenSSL can't verify old end-user certificates against the CRL, because it checks the verification of the CRL against the public key of the certificate that signed the end-user certificate. That's not conformant to the X.509 standard. -- Erwann ABALEA <[EMAIL PROTECTED]>
openssl099-crl-renewedca.diff.gz
Description: Binary data
