问题描述
我正在使用的参考书(Network Security with OpenSSL，Viega、Messier 和 Chandra 合着)，第 133 页指出:
The reference book that I'm working from (Network Security with OpenSSL, by Viega, Messier, and Chandra), on page 133, states:
[...] 应用程序必须加载 CRL 文件，以便内部验证过程确保它验证的每个证书不会被撤销.不幸的是，OpenSSL 的 CRL 功能在 0.9.6 版本中是不完整的.从 0.9.7 开始的新版本中将完成使用 CRL 信息所需的功能.[...]
我在 OpenSSL 文档中找不到任何关于它的可用信息(毫不奇怪).在我看来，检查 CRL 应该是 OpenSSL 验证过程的一个自动部分.CRL 现在是自动处理的，还是我还必须通过书中列出的所有垃圾来费力地验证证书没有被吊销?
I can't find any usable information about it in the OpenSSL documentation (no surprise there). It seems to me that checking the CRLs should be an automatic part of OpenSSL's verification process. Are CRLs handled automatically now, or must I still go through all the garbage listed in the book to laboriously verify that a certificate hasn't been revoked?
一个密切相关的问题:SSL_CTX_set_default_verify_paths 函数是否也加载 CRL 路径?
A closely-related question: does the SSL_CTX_set_default_verify_paths function load CRL paths too?
推荐答案
SSL_CTX_set_default_verify_paths() 只加载 CA 路径，而不是 CRL.
SSL_CTX_set_default_verify_paths() just loads CA paths, not CRLs.
我相信(虽然我自己还没有真正实现过)正确的过程是:
I believe (though I have not yet actually implemented it myself) that the correct process is:
/* Load CRLs into the `X509_STORE` */
X509_STORE *x509_store = SSL_CTX_get_cert_store(ctx);
X509_STORE_add_crl(x509_store, crl);
/* Enable CRL checking */
X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
SSL_CTX_set1_param(ctx, param);
X509_VERIFY_PARAM_free(param);
这篇关于OpenSSL 现在是否会自动处理 CRL(证书吊销列表)?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！