0

CRL file A - http://pastebin.com/ZXGk9p0X
CA file B in directory "dir1" http://pastebin.com/05PKGCjH

openssl crl -in A -CApath dir1

gives the error Error getting CRL issuer certificate

I had earlier posted a similar question - but there my cert was actually wrong.

Here I think it's correct

openssl x509 -in dir1\B

subject= /C=IN/O=India PKI/CN=CCA India 2011

openssl crl -in A -issuer

issuer=/C=IN/O=India PKI/CN=CCA India 2011

How do I troubleshoot this further?

1

Given that you did not specify the filename for the certificate my guess is that you just placed it into the directory given by -CApath without taking care of the special file name as needed. From the documentation of x509:

-subject_hash
outputs the "hash" of the certificate subject name. This is used in OpenSSL to form an index to allow certificates in a directory to be looked up by subject name.

Also the documentation of -CApath for openssl crl states:

-CApath dir
verify the signature on a CRL by looking up the issuing certificate in dir. This directory must be a standard certificate directory: that is a hash of each subject name (using x509 -hash) should be linked to each certificate.

If you use the hash c7f51c60 returned by openssl x509 -subject_hash as the base for the filename, i.e. put the certificate into dir1/c7f51c60.0 then it works. If you don't want to fiddle with these special filename just put all the certificate into a single file and use -CAfile instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.