Hi Dave,
Thanks very much for your help! I've now got the verify stuff working
to my satisfaction.
On Mon, 2010-08-02 at 22:25 -0400, Dave Thompson wrote:
> > My questions are:
> > - Why is openssl trying to find the crl
> > at /usr/lib/ssl/certs/07c527d9.r0?
>
> The search for *certs* is CAfile (commandline option or else default)
> then CApath=directory (ditto), and I believe CRLs should be the same
> (but as I say this part is twisty). You specified a -CAfile;
> is the CRL in that? If so, not finding it may be a bug. If not,
> you didn't specify -CApath so it defaults to OPENSSLDIR/certs
> (where OPENSSLDIR in your case is /usr/lib/ssl).
Thanks, this all makes sense.
> > - Why does it choose to use the crl named 07c527d9.r0? Is this some
> > hash as the filename?
>
> Yes. It is a hash of the issuer=CA name, plus .r0 (or .r1 etc);
> for a cert it is the hash of the subject name plus .0 .1 etc.
> That's how the (hopefully) right file is found (hopefully) fast.
> man s1 {verify,x509} mention this for certs, and man s3
> SSL_CTX_load_verify_locations gives some more detail.
> You have to extrapolate that CRLs are handled the same way.
> tools/c_rehash, which may or may not have been installed to
> somewhere/bin, is a (Unix) perl script to create the links,
> and shows exactly what they need to be.
This was REALLY helpful. I'm not sure how I missed this. Thanks for
pointing this out to me!
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
