On Tue Jul 19 22:23:56 2016, steve wrote: > > If there are multiple CRLs with the appropriate scope then the first > one where > the current time falls between lastUpdate and nextUpdate is used. > > It is possible to dynamically update CRLs but currently only the time > criteria > is used. So if the first one fails the time test the next is used. > This isn't > ideal and something relying on the most recent or the highest CRL > number would > be preferable. >
Please try the attached patch. This should end up using the most recent CRL instead of the first one it sees. I've done some checks and dynamic update works with this change. Note that if you happen to have two CRLs with an identical lastUpdate field (down to the second) then it will just use the first CRL it encounters again. This shouldn't be a problem in practice. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4615 Please log in as guest with password guest if prompted
crl.pat
Description: Binary data
-- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
