Ron, I believe you just need to make the following calls:
int vflags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL; SSL_CTX_load_verify_locations(ctx,CRLfile,CRLpath); store = SSL_CTX_get_cert_store(ctx); X509_STORE_set_flags(store, vflags); Generally, functions that work for CAs also work for CRLs. Note that the SSL_CTX_load_verify_locations only works on PEM encoded CRLs and CAs. On Mon, Jan 11, 2010 at 9:13 AM, ronald braswell <[email protected]> wrote: > > Hi, > > I have published a CRL using openssl. How do I use it in a custom OpenSSL > server to reject certificates in the CRL. Is it as simple as registering a > file in the CTX or do I have to read in the CRL and examine it every time a > client certificate is presented? > > Thanks, > > Ron Braswell ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
