Updating CRLs Without Interrupting Verification
To update the X509 store without interrupting active verification contexts, you must decouple the CRL retrieval process from the OpenSSL verification engine. Since OpenSSL reads the store at the time of context initialization or via specific store lookups, the recommended approach is to use a directory-based CRL store rather than loading a single monolithic file.
By using the -crl_store flag (or the equivalent X509_STORE_load_locations in C), OpenSSL looks up CRLs based on the issuer's hash. To update the store without downtime:
- Download the new CRL to a temporary file.
- Create a symbolic link (or a hashed filename) in the CRL directory pointing to the new file.
- Atomically replace the old symlink with the new one using
mv -T.
Existing verification contexts that have already loaded a CRL into memory will continue using that version until the context is destroyed, while new handshakes will pick up the updated file from the disk.
Preventing Memory Exhaustion with Large CRLs
Loading exceptionally large CRLs into the OpenSSL store can lead to significant memory overhead because the entire list is typically parsed into memory to allow for fast serial number lookups. To mitigate this, consider the following mechanisms:
- CRL Partitioning: If the CA supports it, use multiple smaller CRLs (Partitioned CRLs) rather than one global list. OpenSSL will only load the specific partition required for the certificate being verified.
- Transition to OCSP: For deployments where CRLs grow to tens of megabytes, the recommended mechanism is to move from CRLs to the Online Certificate Status Protocol (OCSP). OCSP provides a definitive status for a single certificate, eliminating the need to load the entire revocation list into memory.
- External Validation: Move the revocation check to a dedicated validation proxy or sidecar that handles the memory-intensive CRL parsing, returning a simple boolean result to the application.
Practical Verification
To verify that your local store is correctly configured and the CRL is being honored, use the following command:
openssl verify -crl_verify -CAfile ca.pem -CRLfile crl.pem cert.pem
To check the expiration date of your current CRL and ensure it has not lapsed (which would cause verification to fail), run:
openssl crl -in crl.pem -text -noout | grep "Next Update"
Diagnostic Requirement
To provide a more specific memory optimization strategy, please specify if you are using the openssl CLI tool for batch verification or integrating libcrypto into a long-running C/C++ application.
openssl