Differences between NSS and OpenSSL CRLs#
NSS Certificate Revocation Lists (CRLs) and OpenSSL CRLs can be stored in the Base-64 encoded format. The only difference is between the accepted header and footer required by OpenSSL versus NSS CRLs†.
† - The Dogtag tool called PrettyPrintCrl is located in the pki-java-tools package, and reads both formats without the need for any conversion. Additionally, the NSS tool called pp can be used to read either format.
NSS CRLs#
The following is an example of an NSS CRL:
Store this CRL in a file called crl.txt.
OpenSSL CRLs#
The following is an example of an OpenSSL CRL:
Store this CRL in a file called crl.pem.
Using Dogtag to Read CRLs#
Most Dogtag Certificate System installations include the following tool to read an NSS CRL:
`` \ **``PrettyPrintCrl``````crl.txt``**
Alternatively, a user can execute the following to read an OpenSSL CRL:
`` \ **``PrettyPrintCrl``````crl.pem``**
In either case, this tool outputs something similar to the following:
Using NSS to Read CRLs#
The following NSS command can also be executed to read an NSS CRL:
``/usr/<lib>/nss/unsupported-tools/pp````````-t````````crl````````-i````````crl.txt````````-a``
where <lib> is either lib on 32-bit architectures, or lib64 on 64-bit architectures.
Alternatively, a user can execute the following to read an OpenSSL CRL:
``/usr/<lib>/nss/unsupported-tools/pp````````-t````````crl````````-i````````crl.pem````````-a``
where <lib> is either lib on 32-bit architectures, or lib64 on 64-bit architectures.
In either case, this tool outputs something similar to the following:
Using OpenSSL to Read and Convert CRLs#
Similarly, running the following OpenSSL command:
``openssl````````crl````````-in````````crl.pem````````-noout````````-text``
Produces the following:
Convert the PEM crl to binary (DER encoded) format:
``openssl````````crl````````-in````````crl.pem````````-out````````binary.crl````````-outform````````DER``
Read a binary CRL (will produce same output above):
``openssl````````crl````````-in````````binary.crl````````-inform````````DER````````-noout````````-text``
Convert the binary (DER encoded) crl to PEM format:
``openssl````````crl````````-in````````binary.crl````````-inform````````DER````````-out````````crl.pem``