title: Finding out which CA Certificate validated a CRL file authenticity
body: <p>Given a certain CRL, for example: </p>
  
  <p><a href="http://crl.verisign.com/pca1.crl" rel="nofollow">http://crl.verisign.com/pca1.crl</a></p>
  
  <p>Downloading it, and asking <code>openssl</code> to verify it and show its contents works like a charm:</p>
  
  <pre><code>wget http://crl.verisign.com/pca1.crl
  openssl crl -in ./pca1.crl -inform DER -text
  verify OK
  Certificate Revocation List (CRL):
          Version 1 (0x0)
          Signature Algorithm: sha1WithRSAEncryption
          Issuer: /C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority
          Last Update: Nov 22 00:00:00 2011 GMT
          Next Update: Mar 21 23:59:59 2012 GMT
  ...
  [truncated]
  </code></pre>
  
  <p>Is there a way to find out <strong><em>which</em></strong> CA certificate validated that this CRL's authenticity? </p>
  
  <p>Or is the only way to loop over the certificates in the certificate store, and try them one by one until a match is hit?</p>