[Help-gnutls] How to check if a certificate is revoked
nmav at gnutls.org
Mon Jun 2 21:09:54 CEST 2008
Martin Lambers wrote:
> Hi all,
> how do I check if a certificate is revoked?
> I created a test CA, signed a certificate, revoked it, and created a CRL
> file with this information.
Please include the CRL that you are talking about. The output of
certtool --crl-info should be sufficient.
> Then I use gnutls_certificate_set_x509_crl_file() in the client program
> to set the CRL file. The function returns 1, as expected.
> After calling gnutls_certificate_verify_peers2(), I check if the status
> contains GNUTLS_CERT_REVOKED, but this is not the case.
Also include the output of -d 2 if you are using gnutls-cli and
gnutls-serv. Otherwise increase the verbosity level to 2 and include the
> Neither openssl s_client nor gnutls-cli seem to support CRL files, so I
> was not able to double check that my test setup is correct.
Use the --x509crlfile parameter to gnutls-cli and gnutls-serv.
More information about the Gnutls-help