Re: Processing of freshestCRL extension in CRLs

[Bruce Stephens <bruce.stephens@xxxxxxxxx>]

Bruce Stephens <bruce.stephens@xxxxxxxxx> writes:

[...]

> And, as it happens, we have no deltaCRLs (so the expected behaviour
> was for verification to fail, which it does does, of course).  And the
> specific CRL has now expired.
>
> Anyway, I'll continue investigating (I'm currently working on
> constructing CRLs with this extension, and deltaCRLs, since OpenSSL
> doesn't directly support these yet).

I should probably stress this.  This is (as far as I know, anyway) of
no operational importance.  I'm just trying to understand exactly
what's happening so (if necessary) I can fix things.