Verify Certificate is revoked by CRL

Question

I set up a CA and signed some cert request.

I revoke them by:

openssl ca -config config.cnf -revoke cert.pem

I update CRL by:

openssl ca -config config.cnf -gencrl -out crl/crl.pem

index.txt shows a 'R' for this cert, also when I check the crl.pem the cert is listed as revoked. So I think that worked fine.

Now the issue: I can not check the cert if its revoked. Can some give me the right command. If I try:

openssl cerify -CAfile cacert.pem cert.pem

I'm not able to find the right syntax to include the crl file. I read something about hashes of the certs? But couldn't figure out how to do it.

Answer 1

You need to specify -crl_check (and spell verify correctly) AND have both the CA cert and the (applicable) CRL in your truststore. There are two ways to do that:

1. concatenate cacert.pem and crl.pem into one file and use that for -CAfile.
2. put or link the cacert PEM file in a directory using the name $hash.0 where $hash is the hash of the cert subject (which for a root cert is also the issuer) as output by openssl x509 -noout -subject_hash -in $cert; and put or link the CRL PEM file in the same directory using the name $hash.r0 where $hash is the hash of the CRL issuer as output by openssl crl -noout -hash -in $crl (which here will be the same as the cert); and use that directory for -CApath. (In a more general case where you have many certs and/or CRLs and there are hash collisions, you increment the 0 to 1 etc.)

Approach 2 is probably the one you have seen referenced, but note it is not the cert nor the CRL as such that is hashed. Depending on whether you're using the source distro of openssl or a packaged build, on Unix it may provide a script c_rehash which sets up symlinks for approach 2; on Windows AFAICT you're on your own, and doing it by hand is rather a nuisance (but possible).