<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">CRLs don't get handled by it directly, you<br>
have to process CDPs yourself and then supply them as X509_CRL objects<br>
directly. So I don't know what it would be asking for. I hesitate to say<br>
you're wrong, but I don't see what I could do to "handle" this critical<br>
extension.</blockquote><div><br></div><div>I dug in a bit further and it seems to be an unsupported extension on the CRL contents itself (not the certificate), the issuerDistributionPoint, which is explicitly marked as critical:</div>
<div><br></div><div><div>CRL extensions:</div><div> X509v3 Issuing Distrubution Point: critical</div></div><div><br></div><div>OpenSSL 0.9.8e, which is the default on RedHat Linux 5, doesn't even read the contents of the extension correctly. Based on some anecdotal information, it's possible that OpenSSL 1.x may actually read the details correctly but to determine whether it would handle it or match it with distribution point identified in the certificate would require additional investigation. Change notes on the OpenSSL site for version 1.0.0 seem to identify that full support for this extension is in progress:</div>
<div><br></div><div>"<span style="background-color:rgb(255,255,255);text-align:-webkit-left">Partial support for Issuing Distribution Point CRL extension. CRLs</span><span style="background-color:rgb(255,255,255);text-align:-webkit-left"> partitioned by DP are handled but no indirect CRL or reason partitioning</span><span style="background-color:rgb(255,255,255);text-align:-webkit-left"> (yet). Complete overhaul of CRL handling: now the most suitable CRL is</span><span style="background-color:rgb(255,255,255);text-align:-webkit-left"> selected via a scoring technique which handles IDP and AKID in CRLs."</span></div>
<div><span style="text-align:-webkit-left"><br></span></div><div><span style="text-align:-webkit-left">How thrilling :P</span></div></div>