X509_CRL_PRINT(3)

✨ X509_CRL_PRINT ✨

okay so bestie, welcome to the X509_CRL_PRINT(3) page 💅 this is one of those manual pages from the libcrypto library, and honestly? it's giving "let me spill all the tea about a certificate revocation list." Periodt.

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int
X509_CRL_print(BIO *bio, X509_CRL *crl);

int
X509_CRL_print_fp(FILE *fp, X509_CRL *crl);

yep, that's it — two little functions, both living their best life inside libcrypto 🫶

---

🦋 DESCRIPTION 🦋

the main character: X509_CRL_print()

X509_CRL_print() takes everything contained in crl and prints it to bio in human-readable form. And it does it in this exact order, no cap:

• first up — the certificate revocation list version number, as defined by the standard, followed in parentheses by the value contained in the version field in hexadecimal notation. if you want the deets, go check X509_CRL_get_version(3) 💖
• then — the name of the signature algorithm gets printed via X509_signature_print(3). iconic.
• then — the issuer name, as returned by X509_CRL_get_issuer(3). slay.
• then — the times of the last and next updates, as returned by X509_CRL_get0_lastUpdate(3) and X509_CRL_get0_nextUpdate(3), are printed with ASN1_TIME_print(3). timestamps, bestie ⏰
• then — all X.509 extensions directly contained in the certificate revocation list object crl are printed with X509V3_extensions_print(3). yes, all of them, we don't skip 💅
• then — info about revoked certificates gets retrieved with X509_CRL_get_REVOKED(3), and for each revoked certificate, the following gets printed:
  • the serial number of the certificate, printed with i2a_ASN1_INTEGER(3) 🎀
  • the revocation date, printed with ASN1_TIME_print(3) 🎀
  • all X.509 extensions contained in the revocation entry, printed with X509V3_extensions_print(3) 🎀
• and finally — the signature of crl is printed with X509_signature_print(3). closing act, main character energy 👑

and the sibling: X509_CRL_print_fp()

X509_CRL_print_fp() is literally the same vibe as X509_CRL_print() — the one difference? it prints to fp. that's it, that's the whole personality 🌈

---

⭐ RETURN VALUES ⭐

these functions are intended to return 1 for success and 0 for error. intended. keep that word in mind, we'll circle back in a sec 🙈

---

🧚 SEE ALSO 🧚

BIO_new(3), X509_CRL_new(3), X509_print_ex(3), X509_REVOKED_new(3) — go read those too, iykyk 📚

---

🎀 HISTORY 🎀

these functions first appeared in OpenSSL 0.9.2 and have been available since OpenBSD 2.6. vintage, honestly. lowkey elder icons 🕰️

---

💀 BUGS 💀

bestie. sit down. we need to talk.

• most I/O errors are silently ignored. like, not even a little "hey something went wrong" — just silence. and even if the information printed is incomplete, these functions may return 1 anyway 😭 so yeah, "intended" is doing a lot of heavy lifting up there in RETURN VALUES.
• if the version number is invalid, no information from the CRL is printed and the functions fail. fair enough, honestly 🫶

---

and that's the page, bestie! Debian, June 8, 2025 — mwah, go print some CRLs responsibly 💜✨