-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 10 Mar 2015, at 15:18, Stefan Winter <stefan.winter@restena.lu> wrote: the cert itself doesn't contain anything re CRLs (including no CRLDP as I just notice). I think you're right about the intermediate being the issue... if your leaf doesn't contain a CRL distribution point then openSSL can't be querying it. I notice that when I'm querying your root CRL, openssl is only returning the first entry. I wonder if it does that when doing an actual validation, as opposed to dumping the CRL. Also From your root CRL: X509v3 Issuing Distrubution Point: 00...,.*https://www.restena.lu/ca/restena-root.crl That looks wrong but given OpenSSL is spelling "distribution" wrong this could be a bug in the text output renderer... Regards, Adam Bishop Systems Development Specialist gpg: 0x6609D460 t: +44 (0)1235 822 245 xmpp: adamb@jabber.dev.ja.net jisc.ac.uk -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJU/xwOAAoJEKTthRWhpiMvEn4P/03krv2M8xmk8em7kGexnqBH rbWjfwkhl2vOTttd+DMjD8KDK5FtpC9c2VCyAo/TgiYX+nh/6PVTxwW4K2rgAPBk XeqdyMIyM92OSH+AZ7kS7nEnQ7yYCU2crLsVqCRoSnOvSHYqwj/vcWPh/Ppj3yN/ 86b2NB5Lw5xU50U66U2xixVI1ClvxOjxGz1GXQqe3HSOdLYw0b2XXXo9K6YeyWXo YkvddCXTpFIN+lHfxDa0w3kg83Sq/lgfnTQJ4jasKn1AQiJwTfvlFzCE8MdjwFUa 7VO3Yj/Q+94jKcZSuizJlbljWdMOh56erKAN4/mx89W4uPTWuFvrgoeWi6VT7vZ2 eQylIRepX5UJCOr1oHEPkm8hHRsJh+UfcEWaozkTfERPu8cHRvVYsMKIzn507Tf9 huW0cCKiJ/mCqEFt7GQtPt56LTA7DeqgXmAjtkxsQ6zikhNH9UQq86LnMWeQdPMM iipbDTHz8HVBAQM/D4fiwUAvh2U0f4XCvp31Nqg1lnNfdFnmJAIRrzn363s6PRvR m3ESoSO8r1qYzu1w77MV2By9rLfW05IiBKo6yx/+KBu6ddMbc+LexJiORJ/lou+T 5ZaRwlPY5s5Op8C8TV/TITH4QxlMHWLBXb5rP6ILrh5b6NTX7pW1heS8nXfh3cPD x1t7abZOZ2Vx7PjrTSde =uHME -----END PGP SIGNATURE----- Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.