CRL介绍

CRL介绍

科技前沿 • 2025-03-01 10:21 • 阅读 44

大家好，我是讯享网，很高兴认识大家。

证书撤销列表(Certificate Revocation List，简称CRL)，是一种包含撤销的证书列表的签名数据结构。CRL是证书撤销状态的公布形式，CRL就像信用卡的黑名单，用于公布某些数字证书不再有效。

CRL是一种离线的证书状态信息。它以一定的周期进行更新。CRL可以分为完全CRL和增量CRL。在完全CRL中包含了所有的被撤销证书信息，增量CRL由一系列的CRL来表明被撤销的证书信息，它每次发布的CRL是对前面发布CRL的增量扩充。

基本的CRL信息有：被撤销证书序列号、撤销时间、撤销原因、签名者以及CRL签名等信息。

基于CRL的验证是一种不严格的证书认证。CRL能证明在CRL中被撤销的证书是无效的。但是，它不能给出不在CRL中的证书的状态。如果执行严格的认证，需要采用在线方式进行认证，即OCSP认证。

struct X509_crl_info_st { ASN1_INTEGER *version; /* version: defaults to v1(0) so may be NULL */ X509_ALGOR sig_alg; /* signature algorithm */ X509_NAME *issuer; /* CRL issuer name */ ASN1_TIME *lastUpdate; /* lastUpdate field */ ASN1_TIME *nextUpdate; /* nextUpdate field: optional */ STACK_OF(X509_REVOKED) *revoked; /* revoked entries: optional */ STACK_OF(X509_EXTENSION) *extensions; /* extensions: optional */ ASN1_ENCODING enc; /* encoding of signed portion of CRL */ }; struct X509_crl_st { X509_CRL_INFO crl; /* signed CRL data */ X509_ALGOR sig_alg; /* CRL signature algorithm */ ASN1_BIT_STRING signature; /* CRL signature */ int references; int flags; /* * Cached copies of decoded extension values, since extensions * are optional any of these can be NULL. */ AUTHORITY_KEYID *akid; ISSUING_DIST_POINT *idp; /* Convenient breakdown of IDP */ int idp_flags; int idp_reasons; /* CRL and base CRL numbers for delta processing */ ASN1_INTEGER *crl_number; ASN1_INTEGER *base_crl_number; STACK_OF(GENERAL_NAMES) *issuers; /* hash of CRL */ unsigned char sha1_hash[32 /*SHA_DIGEST_LENGTH*/]; /* alternative method to handle this CRL */ const X509_CRL_METHOD *meth; void *meth_data; CRYPTO_RWLOCK *lock; }; struct x509_revoked_st { ASN1_INTEGER serialNumber; /* revoked entry serial number */ ASN1_TIME *revocationDate; /* revocation date */ STACK_OF(X509_EXTENSION) *extensions; /* CRL entry extensions: optional */ /* decoded value of CRLissuer extension: set if indirect CRL */ STACK_OF(GENERAL_NAME) *issuer; /* revocation reason: set to CRL_REASON_NONE if reason extension absent */ int reason; /* * CRL entries are reordered for faster lookup of serial numbers. This * field contains the original load sequence for this entry. */ int sequence; };

讯享网

相关推荐