I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (
crlset fetch > crl-set) and then dumped the serial numbers (
crlset dump crl-set) so I see something like this:
f24196ae94078667348f02e8e37458a3a6e6aad1e0b0dc610118cce721427bfc 03fb3b4d35074e 03fbf94a0e6c39 04097214d6c97c 0442c6b3face55 ....
I want to be able to pass to openssl or curl (which uses openssl) a CRL file containing a master list of all bad serials. For example rather than just passing in verisign's crl, I want everything passed in. I thought I could do this with crlset but I don't think the format is compatible. I tried
openssl crl -inform DER -text -in crl-set but it says:
unable to load CRL 5532:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c: 1319: 5532:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:ta sn_dec.c:381:Type=X509_CRL
If anyone has any ideas on how to do what I'm talking about or any creative way to do this please let me know. Thanks