<html><font size="2"><font face="Arial">Hey openssl users,<br><br>I am testing with revoking certificates.<br><br>My PKI has a root and 2 intermediates, which then sign server and client certificates<br>My test environment consists of a s_client and a s_server referencing the corresponding files and a verifydir with c_rehased files.<br>TLS connections work fine from s_client to s_server, chain is exposed and recognized properly.<br><br>I successfully revoked server-certificates with the intermediate ca crl. <br>When trying to connect using the s_client "-crl_check" arg the "certificate revoked" notification shows up correctly.<br><br>I also successfully created a crl with the root ca, that revokes one of the intermediates.<br></font></font><font size="2"><font face="Arial"><font size="2"><font face="Arial">The serialnumber of the revoked intermediate is shown correctly in the crl and the
crl is c_rehashed in the verify dir of the client.<br></font></font>But no matter what i try, the s_client does NOT show the </font></font><font size="2"><font face="Arial"><font size="2"><font face="Arial">"certificate revoked"</font></font> when I connect to the corresponding s_server using the certificate signed by the revoked intermediate.<br><br>Any ideas what i could be doing wrong?<br><br>I am on version OpenSSL 1.0.1f 6 Jan 2014<br><br>Best Regards<br>Micha<br></font></font>
<br /><br />
______________________________________________________<br />
powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure internet.</html>