Using Certificate Revocation Lists in C programs

A CRL is a data structure that lists revoked certificates. A certificate can be revoked for several reasons, such as private key compromise, private key loss, an error in the certificate, cessation of operations by the certificate owner, the certificate being superseded by another certificate, and so on.

CRLs can often be downloaded from the Certificate Authority (CA) web servers. Those downloadable CRLs are often represented in Distinguished Encoding Rules (DER) format. For instance, a CRL for the www.example.org site certificate can be downloaded from http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl.

Once downloaded to a file, a CRL can be viewed with the openssl command-line tool using the openssl crl subcommand:

$ openssl crl \
    -in DigiCertTLSRSASHA2562020CA1-4.crl \
    -inform DER \
    -noout \
    -text \
   ...