OpenSSL CRL Verification and Local Store Configuration

Certificate Revocation List (CRL) Validation

OpenSSL provides the -crl_checks flag within the X509 verification store to ensure that certificates are checked against revocation lists during the chain validation process.

A primary constraint is that OpenSSL does not natively perform network requests to fetch CRLs from Distribution Points (CDPs) defined in the certificate extensions. The application layer is responsible for retrieving these files and loading them into the local store before verification occurs.

When managing large-scale deployments, there is uncertainty regarding the optimal method for updating the local CRL store without interrupting active TLS handshakes or causing excessive memory overhead during the openssl verify process.

• How can the X509 store be updated with new CRLs while maintaining the validity of existing verification contexts?
• What is the recommended mechanism to prevent memory exhaustion when loading exceptionally large CRL files into the OpenSSL store?