On Thu, Apr 22, 2010, Jan Gillar wrote: > Hi, > I have problem with retrieving CRLs with my custom lookup method. With > 0.9.8h it is working as expected but with 1.0.0 I'm still getting > X509_V_ERR_UNABLE_TO_GET_CRL. I found that CRL is successfully retrived > with X509_STORE_get_by_subject called from X509_STORE_get1_crls (file > x509_lu.c, line 551) but after that is received CRL immediately freed by > X509_OBJECT_free_contents (file x509_lu.c, line 556) and not used anymore. > It doesn't make any sense to me. Is it a bug?
All CRLs matching the subject name are looked up and added to the cache and then freed up to get the reference counts correct. They are then looked up again from the cache (this is a workaround for a limitation of the API). OpenSSL 1.0.0 includes some additional checks for CRLs which aren't in 0.9.8 including AKID checks. That might be the problem. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
