OPENSSL-CRL(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 OPENSSL-CRL 💖

aka the openssl crl command, my beloved

okay so bestie, welcome to the CRL glow-up page 💅 this is the manual for openssl-crl(1ssl) and we're gonna get you fully fluent, no gatekeeping, periodt.

✨ SYNOPSIS ✨

openssl crl [-help] [-inform DER|PEM] [-outform DER|PEM] [-key filename]
[-keyform DER|PEM|P12] [-dateopt] [-text] [-in filename] [-out filename]
[-gendelta filename] [-badsig] [-verify] [-noout] [-hash] [-hash_old]
[-fingerprint] [-crlnumber] [-issuer] [-lastupdate] [-nextupdate]
[-nameopt option] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath]
[-CAstore uri] [-no-CAstore] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq]

🌸 DESCRIPTION 🌸

So basically this command processes CRL files — and it handles them in either DER or PEM format. That's the whole job description. She's focused. She's slaying. 🎀

👑 OPTIONS 👑

every single one, babes. no skips. we're listing all of them fr fr.

  • -help — prints out a usage message. cute little "here's how to use me" moment 🫶
  • -inform DER|PEM — the format of the CRL you're feeding in. it's unspecified by default, so if you don't say, she'll figure it out. full details live in openssl-format-options(1) 📖
  • -outform DER|PEM — the format you want the CRL spat back out in. default is PEM. again, openssl-format-options(1) has the lore ✨
  • -key filename — the private key you're gonna use to sign the CRL 🔑
  • -keyform DER|PEM|P12 — what format that private key file is in. unspecified by default. openssl-format-options(1), as always 💅
  • -in filename — the input file to read from. if you just... don't specify it? she reads from standard input. no pressure 💖
  • -out filename — the file to write to. defaults to standard output if you don't name one ✨
  • -gendelta filename — outputs a comparison between the main CRL and the one you point at here. side-by-side tea ☕
  • -badsig — corrupts the signature before writing it. which sounds unhinged but it's genuinely useful for testing 🙈
  • -dateopt — sets the date output format. the values are: rfc_822 and iso_8601. defaults to rfc_822 📅
  • -text — prints the CRL out in text form. human-readable era 🌸
  • -verify — verifies the signature inside the CRL. if verification fails, the program immediately exits, meaning any further option processing (hi, -gendelta) gets skipped entirely. bye 👋

this option is implicitly enabled if you specify any of -CApath, -CAfile or -CAstore.

  • -noout — don't output the encoded version of the CRL. she stays quiet 🤫
  • -fingerprint — outputs the fingerprint of the CRL 🫆
  • -crlnumber — outputs the number of the CRL 🔢
  • -hash — outputs a hash of the issuer name. useful for looking up CRLs in a directory by issuer name 🔍
  • -hash_old — outputs the "hash" of the CRL issuer name using the older algorithm, the one OpenSSL used before version 1.0.0. vintage, but make it functional 🕰️
  • -issuer — outputs the issuer name 🏷️
  • -lastupdate — outputs the lastUpdate field ⏰
  • -nextupdate — outputs the nextUpdate field ⏭️
  • -nameopt option — specifies how subject or issuer names get displayed. openssl-namedisplay-options(1) for the full menu 🎀
  • -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore — for the details, go read "Trusted Certificate Options" in openssl-verification-options(1) 🛡️
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — all the provider lore lives in "Provider Options" in openssl(1), plus provider(7) and property(7) 🧚

🌈 EXAMPLES 🌈

convert a CRL file from PEM to DER:

openssl crl -in crl.pem -outform DER -out crl.der

output the text form of a DER encoded certificate:

openssl crl -in crl.der -text -noout

💀 BUGS 💀

ngl, ideally you'd be able to create a CRL using the appropriate options and files too. that would be the dream. we're not there yet 😭

🦋 SEE ALSO 🦋

openssl(1), openssl-crl2pkcs7(1), openssl-ca(1), openssl-x509(1), ossl_store-file(7)

📜 HISTORY 📜

since OpenSSL 3.3, -verify will exit with 1 on failure. noted, bestie 📝

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate that 💅 this was OpenSSL 4.0.3, dated 2026-09-29 — the OPENSSL-CRL(1SSL) era, and you were there for it. go forth and slay your CRLs, bestie 💖✨🫶

📦 where this page comes from