Class X509CRL

The X509CRL class is the abstract class used to manage X.509 Certificate Revocation Lists. The CRL is a list of time stamped entries which indicate which lists have been revoked. The list is signed by a Certificate Authority (CA) and made publically available in a repository. Each revoked certificate in the CRL is identified by its certificate serial number. When a piece of code uses a certificate, the certificates validity is checked by validating its signature and determing that it is not only a recently acquired CRL. The recently aquired CRL is depends on the local policy in affect. The CA issues a new CRL periodically and entries are removed as the certificate expiration date is reached A description of the X.509 v2 CRL follows below from rfc2459. "The X.509 v2 CRL syntax is as follows. For signature calculation, the data that is to be signed is ASN.1 DER encoded. ASN.1 DER encoding is a tag, length, value encoding system for each element. CertificateList ::= SEQUENCE { tbsCertList TBSCertList, signatureAlgorithm AlgorithmIdentifier, signatureValue BIT STRING } TBSCertList ::= SEQUENCE { version Version OPTIONAL, -- if present, shall be v2 signature AlgorithmIdentifier, issuer Name, thisUpdate Time, nextUpdate Time OPTIONAL, revokedCertificates SEQUENCE OF SEQUENCE { userCertificate CertificateSerialNumber, revocationDate Time, crlEntryExtensions Extensions OPTIONAL -- if present, shall be v2 } OPTIONAL, crlExtensions [0] EXPLICIT Extensions OPTIONAL -- if present, shall be v2 }"

Since: 1.2