NAME

crl − CRL utility

SYNOPSIS

openssl crl [−inform PEM | DER] [−outform PEM | DER] [−text] [−in filename] [−out filename] [−noout] [−hash] [−issuer] [−lastupdate] [−nextupdate] [−CAfile file] [−CApath dir]

OPTIONS

−inform DER|PEM
Specifies the input format. The DER format is DER encoded CRL structure. The PEM format (the default) is a base64 encoded version of the DER form with header and footer lines. 

−outform DER|PEM
Specifies the output format. The options have the same meaning as the −inform option. 

−in filename
Specifies the input filename to read from or standard input if this option is not specified.

−out filename
Specifies the output filename to write to or standard output by default.

−textPrints out the CRL in text form. 

−nooutDoes not output the encoded version of the CRL. 

−hashOutputs a hash of the issuer name. This can be used to lookup CRLs in a directory by issuer name. 

−issuerOutputs the issuer name. 

−lastupdate
Outputs the lastupdate field.

−nextupdate
Outputs the nextupdate field.

−CAfile file
Verifies the signature on a CRL by looking up the issuing certificate in file

−CApath dir
Verifies the signature on a CRL by looking up the issuing certificate in dir. This directory must be a standard certificate directory; that is, a hash of each subject name (using x509 −hash) should be linked to each certificate. 

DESCRIPTION

The crl command processes CRL files in DER or PEM format. 

NOTES

The PEM CRL format uses the header and footer lines:

 -----BEGIN X509 CRL-----
 -----END X509 CRL-----

RESTRICTIONS

Ideally it should be possible to create a CRL using appropriate options and files. 

EXAMPLES

Convert a CRL file from PEM to DER:

 openssl crl -in crl.pem -outform DER -out crl.der

Output the text form of a DER encoded certificate:

 openssl crl -in crl.der -text -noout

SEE ALSO

Commands: crl2pkcs7(1ssl), ca(1), x509(1ssl)