[openssl-users] C++ : Extracting CRL from a PKCS12
Dr. Stephen Henson
steve at openssl.org
Mon Nov 14 20:11:09 UTC 2016
On Wed, Nov 02, 2016, Richard Stanek wrote:
> My original requirements were to extract the user certificate, the
> private key, and the CAs. For that I was using the call to
> PKCS12_parse(...). This satisfied the original requirements. Very
> easy to find, understand, and use.
> The new requirements that I have are that I also need to extract a CRL
> from that PKCS12. I see that there is a CRLBag defined in the IETF
> RFC 7292 PKCS12 Standard (https://tools.ietf.org/html/rfc7292), so I
> know a CRL could exist inside a PKCS12. I can't seem to find any API
> or C++ examples that extract a CRL from a PKSC12.
> Is there an API, example code, or advice on how to extract a CRL from a PKCS12?
I've never come across a PKCS#12 file containig a CRL before: would it be
possible to send me a sample which obviously doesn't contain any important
To answer your question, yes it is should be possible but it is messy. You
need to parse the PKCS#12 file manually (see source to PKCS12_parse). In
the funtion parse_bag you add an extra case for NID_crlBag and call
PKCS12_SAFEBAG_get1_crl() on the bag, you should then get back an X509_CRL
pointer or NULL on error.
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
More information about the openssl-users