title: Verify certificate chain against CRL with openssl
body: <p>I'm trying to learn about certificate and CRL handling, so I created the following example certificate chain:</p>
  
  <p>Root CA (self-signed) &rarr; Intermediate CA (signed by Root CA) &rarr; Server Cert (signed bei Intermediate CA)</p>
  
  <p>Now I would like to test certificate revocation to be effective. To do so, I revoke the Server Cert and create a CRL file (of the Intermediate CA) accordingly. The X509v3 CRL Distribution Points are present in all of the certificate files, and they are accessible via http, like:</p>
  
  <pre><code>X509v3 CRL Distribution Points:
      Full Name:
        URI:http://127.0.0.1:80/intermediate_ca.crl
  </code></pre>
  
  <p>(Which is the CRL I just created. (The same for the Root CA CRL at <a href="http://127.0.0.1:80/ca.crl" rel="nofollow noreferrer">http://127.0.0.1:80/ca.crl</a>.) I double-checked they are really present and accessible at that URI.)</p>
  
  <p>Next, I <code>cat</code> the Root CA <code>pem</code> file and the Intermediata CA <code>pem</code> file into <code>CAChain.pem</code>.</p>
  
  <p>I'd like to have a command that receives the Server Cert and the <code>CAChain.pem</code> and "crawls up" the certificate chain in order verify it in total.</p>
  
  <p>I tried going with</p>
  
  <p><code>openssl verify -extended_crl -crl_check_all -crl_download -CAfile CAChain.pem -verbose serverCert.pem</code></p>
  
  <p>but I just get: </p>
  
  <pre><code>Error loading CRL from http://127.0.0.1:80/ca.crl
  140041593399104:error:27076072:OCSP routines:parse_http_line1:server response error:crypto/ocsp/ocsp_ht.c:260:Code=404,Reason=Not Found
  ...
  error 3 at 0 depth lookup: unable to get certificate CRL
  </code></pre>
  
  <p>Again, the CRL is <em>really</em> present at the URI denoted. That's why I can't explain the error 404. (Additionally it seems a little strange to me, that the error arises from an OSCP module as I'm just using CRL at the moment.)</p>
  
  <p>I would highly appreciate if someone could tell me what my mistake is and how I can achieve what I originally intended (verifying the whole cert chain using the CRLs). Thanks in advance!</p>