使用OpenSSL结合CA文件与CRL文件验证证书遇问题求助

Let’s walk through fixing your OpenSSL setup for extracting CA info and validating certificate revocation. Since you didn’t share the exact error message you’re seeing, I’ll break down the most common pitfalls and step-by-step checks to resolve them.

First, Double-Check Your Command Syntax #

OpenSSL can be finicky about parameter order and flags. Let’s start with your existing command:

openssl verify -verbose -CAfile CAFile.pem -untrusted CRLSign.pem -CRLfile CRLfile.pem -crl_check -extended_crl certToDecrypt.pem

A quick note: The -untrusted flag is for intermediate certs that aren’t part of your trusted root chain. If your CRL is signed by a dedicated CRL signer (not your root CA), we need to make sure OpenSSL recognizes that signer as valid for CRL validation—we’ll cover that in the next steps.

Step 1: Validate Each Component Separately #

Don’t jump straight to the full verification command—test each file individually to rule out basic issues:

• Check your root CA certificate:

  openssl x509 -in CAFile.pem -noout -text
  

  Confirm the Validity dates are current, and under X509v3 Basic Constraints it shows CA:TRUE (this marks it as a valid root CA).
• Verify your CRL signer certificate:

  openssl x509 -in CRLSign.pem -noout -text
  

  Look for X509v3 Extended Key Usage and ensure it includes CRL Sign—this is required for the cert to sign revocation lists. Also confirm its issuer matches the subject of your root CA (unless it’s issued by an intermediate CA you’re including in the chain).
• Validate the CRL itself:

  openssl crl -in CRLfile.pem -noout -text -CAfile CAFile.pem -untrusted CRLSign.pem
  

  This checks if the CRL is properly signed and hasn’t expired. Look for a valid Signature Algorithm match, and confirm the Next Update date is in the future.

Step 2: Fix Common CRL Verification Issues #

Issue 1: CRL Signer Isn’t Properly Trusted #

If your CRL is signed by a dedicated signer (not the root CA), you might need to combine the root CA and CRL signer into a single file for OpenSSL to validate the CRL chain correctly:

cat CAFile.pem CRLSign.pem > combined_ca_chain.pem

Then run the verification command with this combined file:

openssl verify -verbose -CAfile combined_ca_chain.pem -CRLfile CRLfile.pem -crl_check -extended_crl certToDecrypt.pem

This ensures OpenSSL can trace the CRL’s signature back to a trusted root.

Issue 2: Unexpected "Certificate Revoked" Error #

Wait—if your target certificate is supposed to be revoked, seeing an error like error 23 at 0 depth lookup: certificate revoked is actually expected behavior. The openssl verify command returns 0 only if the certificate is valid (not revoked) and passes all checks. If the cert is revoked, it will throw this error to alert you.

Issue 3: Extended CRL Checks Failing #

The -extended_crl flag enables validation of optional CRL extensions like revocation reason codes or invalidity dates. If your CRL doesn’t include these extensions, this flag shouldn’t cause issues—but if your use case requires them, double-check the CRL output (from the openssl crl -text command) to confirm they’re present.

Issue 4: Mismatched Certificate Chain #

Your target certificate (certToDecrypt.pem) might have an issuer that doesn’t match your root CA. Verify this with:

# Get target cert's issuer
openssl x509 -in certToDecrypt.pem -noout -issuer
# Get root CA's subject
openssl x509 -in CAFile.pem -noout -subject

If they don’t match, you’re missing an intermediate CA certificate. Add that intermediate to your -untrusted list (or combine it with your CA chain file) to fix the chain.

Step 3: Capture the Exact Error Message #

To narrow things down fast, run your command with the -debug flag to get detailed error output:

openssl verify -verbose -debug -CAfile CAFile.pem -untrusted CRLSign.pem -CRLfile CRLfile.pem -crl_check -extended_crl certToDecrypt.pem

The debug output will tell you exactly what’s failing—whether it’s a signature mismatch, expired CRL, missing chain component, or revoked certificate.

内容的提问来源于stack exchange，提问作者Hugo Gallet