I set up a CA and signed some cert request.
I revoke them by:
openssl ca -config config.cnf -revoke cert.pem
I update CRL by:
openssl ca -config config.cnf -gencrl -out crl/crl.pem
index.txt shows a 'R' for this cert, also when I check the crl.pem the cert is listed as revoked. So I think that worked fine.
Now the issue: I can not check the cert if its revoked. Can some give me the right command. If I try:
openssl cerify -CAfile cacert.pem cert.pem
I'm not able to find the right syntax to include the crl file. I read something about hashes of the certs? But couldn't figure out how to do it.