OPENSSL-CRL(1ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💖 openssl-crl 💖

okay bestie, so this is openssl-crl — it lives in the OpenSSL family of manual pages, and it's literally just called the CRL command. CRL = Certificate Revocation List, iykyk. Let's get into it 🎀

✨ SYNOPSIS ✨

openssl crl [-help] [-inform DER|PEM] [-outform DER|PEM] [-key filename]
[-keyform DER|PEM|P12] [-dateopt] [-text] [-in filename] [-out filename]
[-gendelta filename] [-badsig] [-verify] [-noout] [-hash] [-hash_old]
[-fingerprint] [-crlnumber] [-issuer] [-lastupdate] [-nextupdate]
[-nameopt option] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath]
[-CAstore uri] [-no-CAstore] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq]

🌸 DESCRIPTION 🌸

So like, this command processes CRL files that are in either DER or PEM format. That's the whole vibe. She's a CRL-processing icon and she knows it 💅

🦋 OPTIONS 🦋

  • -help — prints out a usage message so you're not just out here guessing. 🫶
  • -inform DER|PEM — the format of the CRL you're feeding in. If you don't say anything, it's unspecified by default — no assumptions made, very demure. Peep openssl-format-options(1) for the deets.
  • -outform DER|PEM — the format of the CRL you're getting out. Default is PEM. Again, openssl-format-options(1) has the full rundown.
  • -key filename — the private key that's gonna be used to sign the CRL. 🔑
  • -keyform DER|PEM|P12 — what format that private key file is in; unspecified by default. See openssl-format-options(1).
  • -in filename — tells her which input filename to read from. Don't specify it and she'll just take standard input, no big deal.
  • -out filename — which output filename to write to. Default is standard output.
  • -gendelta filename — outputs a comparison between the main CRL and the one you specify here. cute little side-by-side moment ✨
  • -badsig — deliberately corrupts the signature before writing it out. Yes, on purpose. It's for testing, bestie — do not ship this. 💀
  • -dateopt — sets the date output format. The values are: rfc_822 and iso_8601. Defaults to rfc_822.
  • -text — prints the CRL out in text form. readable queen 👑
  • -verify — verifies the signature inside the CRL. If verification fails, the program immediately exits — like, immediately — so any further option processing (e.g. -gendelta) gets skipped. 🚨

Also lowkey important: this option is implicitly enabled if any of -CApath, -CAfile or -CAstore is specified.

  • -noout — don't output the encoded version of the CRL. withholding, honestly.
  • -fingerprint — outputs the fingerprint of the CRL.
  • -crlnumber — outputs the number of the CRL.
  • -hash — outputs a hash of the issuer name. Super handy for looking up CRLs in a directory by issuer name. 🗂️
  • -hash_old — outputs the "hash" of the CRL issuer name using the older algorithm, the one OpenSSL used before version 1.0.0. vintage behavior fr.
  • -issuer — outputs the issuer name.
  • -lastupdate — outputs the lastUpdate field.
  • -nextupdate — outputs the nextUpdate field.
  • -nameopt option — how the subject or issuer names get displayed. See openssl-namedisplay-options(1) for the full menu.
  • -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore — head to "Trusted Certificate Options" in openssl-verification-options(1) for all the details. 🫡
  • -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — these live under "Provider Options" in openssl(1), provider(7), and property(7). go read those if you wanna go deeper 🧚

🌈 EXAMPLES 🌈

Convert a CRL file from PEM to DER:

openssl crl -in crl.pem -outform DER -out crl.der

Output the text form of a DER encoded certificate:

openssl crl -in crl.der -text -noout

💀 BUGS 💀

Ideally you'd be able to create a CRL using the appropriate options and files too. Alas. Not yet. That's the dream, bestie 😭

⭐ SEE ALSO ⭐

openssl(1), openssl-crl2pkcs7(1), openssl-ca(1), openssl-x509(1), ossl_store-file(7)

🎀 HISTORY 🎀

Ever since OpenSSL 3.3, the -verify option will exit with 1 on failure. noted! 📝

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

💖 and that's the whole page, bestie!! this one's from OpenSSL version 3.5.6, dated 2026-04-07, and it's the OPENSSL-CRL(1ossl) manual — slay, go process some CRLs, ily 🫶✨
📦 where this page comes from