Re: [PATCH 0/3] Add CRL checking to server and client

Chuck Lever
2025-06-11T13:49:11Z

On 6/11/25 3:09 AM, Rik Theys wrote:
> These patches add CRL checking to the TLS client and server code.
>
> It introduces an x509.crl configuration option that specifies the
> location of a CRL in PEM format.
>
> The CRL (certificate revocation list) can be used by an administrator
> to block access to certificates that should no longer be trusted
> for some reason.
>
> See https://github.com/oracle/ktls-utils/issues/103
>
> Rik Theys (3):
> Add server-side CRL checking
> Add client-side CRL checking
> Add x509.crl option to man page.
>
> src/tlshd/client.c | 28 +++++++++++++++++
> src/tlshd/config.c | 66 ++++++++++++++++++++++++++++++++++++++++
> src/tlshd/server.c | 14 +++++++++
> src/tlshd/tlshd.conf.man | 9 +++++-
> src/tlshd/tlshd.h | 2 ++
> 5 files changed, 118 insertions(+), 1 deletion(-)
>

Also note that this will need a similar code change to the QUIC paths,
eventually.

--
Chuck Lever