{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/pyopenssl/issues/256","labels_url":"https://api.github.com/repos/pyca/pyopenssl/issues/256/labels{/name}","comments_url":"https://api.github.com/repos/pyca/pyopenssl/issues/256/comments","events_url":"https://api.github.com/repos/pyca/pyopenssl/issues/256/events","html_url":"https://github.com/pyca/pyopenssl/issues/256","id":74404948,"number":256,"title":"X509StoreContext should accept CRLs","user":{"login":"bgaifullin","id":5380830,"avatar_url":"https://avatars.githubusercontent.com/u/5380830?v=3","gravatar_id":"","url":"https://api.github.com/users/bgaifullin","html_url":"https://github.com/bgaifullin","followers_url":"https://api.github.com/users/bgaifullin/followers","following_url":"https://api.github.com/users/bgaifullin/following{/other_user}","gists_url":"https://api.github.com/users/bgaifullin/gists{/gist_id}","starred_url":"https://api.github.com/users/bgaifullin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgaifullin/subscriptions","organizations_url":"https://api.github.com/users/bgaifullin/orgs","repos_url":"https://api.github.com/users/bgaifullin/repos","events_url":"https://api.github.com/users/bgaifullin/events{/privacy}","received_events_url":"https://api.github.com/users/bgaifullin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-05-08T15:41:17Z","updated_at":"2015-06-15T05:10:47Z","closed_at":null,"body":"Now, there is no possibility to use CRLS with verify_certificate method"},"comment":{"url":"https://api.github.com/repos/pyca/pyopenssl/issues/comments/111923852","html_url":"https://github.com/pyca/pyopenssl/issues/256#issuecomment-111923852","issue_url":"https://api.github.com/repos/pyca/pyopenssl/issues/256","id":111923852,"user":{"login":"sholsapp","id":969813,"avatar_url":"https://avatars.githubusercontent.com/u/969813?v=3","gravatar_id":"","url":"https://api.github.com/users/sholsapp","html_url":"https://github.com/sholsapp","followers_url":"https://api.github.com/users/sholsapp/followers","following_url":"https://api.github.com/users/sholsapp/following{/other_user}","gists_url":"https://api.github.com/users/sholsapp/gists{/gist_id}","starred_url":"https://api.github.com/users/sholsapp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sholsapp/subscriptions","organizations_url":"https://api.github.com/users/sholsapp/orgs","repos_url":"https://api.github.com/users/sholsapp/repos","events_url":"https://api.github.com/users/sholsapp/events{/privacy}","received_events_url":"https://api.github.com/users/sholsapp/received_events","type":"User","site_admin":false},"created_at":"2015-06-15T05:10:47Z","updated_at":"2015-06-15T05:10:47Z","body":"Heh, so in fact, I apparently don't understand how CRL works.\r\n\r\nAfter some more reading, it seems that the CRL is just a list of serial number -- not the certificates themselves -- which are signed by the CA to prevent tampering. So, no cryptographic mapping of the certificate being described in the CRL to the certificate itself is possible... you just have to trust the CA that signed the CRL and hope they didn't goof up the serial number and issuer name. Seems broken to me, but oh well. :smile:\r\n\r\nSorry for the noise."}}