Delta CRL and verify app -extended_crl flag

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

Delta CRL and verify app -extended_crl flag

Heikki Vatiainen
I started experimenting with delta CRLs and noticed that 'openssl
verify' in OpenSSL distribution test suite uses -extended_crl flag with
-use_deltas. The documentation is not clear if 'extended CRL features'
also covers delta CRLs and if it is required for deltas to work.

The corresponding verify flags are also mentioned on  the
X509_VERIFY_PARAM_set_flags manual page, with some caveats regarding
delta CRLs, but otherwise there seem to be few examples in the net about
what options to use.

Can anyone confirm if -extended_crl is required for delta CRLs? If it
is, I can submit a documentation update to make clarify this.

Here are the docs I've used:

https://www.openssl.org/docs/manmaster/man1/verify.html

https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html

Thanks,
Heikki

--
Heikki Vatiainen