0

CRL file A - http://pastebin.com/ZXGk9p0X
CA file B in directory "dir1" http://pastebin.com/05PKGCjH

openssl crl -in A -CApath dir1

gives the error Error getting CRL issuer certificate

I had earlier posted a similar question - but there my cert was actually wrong.

Here I think it's correct

openssl x509 -in dir1\B

subject= /C=IN/O=India PKI/CN=CCA India 2011

openssl crl -in A -issuer

issuer=/C=IN/O=India PKI/CN=CCA India 2011

How do I troubleshoot this further?

1 Answer 1

1

Given that you did not specify the filename for the certificate my guess is that you just placed it into the directory given by -CApath without taking care of the special file name as needed. From the documentation of x509:

-subject_hash
outputs the "hash" of the certificate subject name. This is used in OpenSSL to form an index to allow certificates in a directory to be looked up by subject name.

Also the documentation of -CApath for openssl crl states:

-CApath dir
verify the signature on a CRL by looking up the issuing certificate in dir. This directory must be a standard certificate directory: that is a hash of each subject name (using x509 -hash) should be linked to each certificate.

If you use the hash c7f51c60 returned by openssl x509 -subject_hash as the base for the filename, i.e. put the certificate into dir1/c7f51c60.0 then it works. If you don't want to fiddle with these special filename just put all the certificate into a single file and use -CAfile instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .