CRL verify the entire chain including loaded CA's

.gitignore

@@ -410,6 +410,7 @@ XXX-fips-test
 
 # ASYNC
 /wolfAsyncCrypt
+/async
 
 # Generated user_settings_asm.h.
 user_settings_asm.h

certs/crl/ca-int-ecc.pem

@@ -1,10 +1,10 @@
 -----BEGIN X509 CRL-----
-MIIBYDCCAQUCAQEwCgYIKoZIzj0EAwIwgaMxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
+MIIBXjCCAQUCAQEwCgYIKoZIzj0EAwIwgaMxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
 DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NM
 MRQwEgYDVQQLDAtEZXZlbG9wbWVudDEkMCIGA1UEAwwbd29sZlNTTCBJbnRlcm1l
 ZGlhdGUgQ0EgRUNDMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0y
-MDA2MTYxOTE3NThaFw0yMzAzMTMxOTE3NThaoDAwLjAfBgNVHSMEGDAWgBQTtXlZ
-MrO7tEezNA6AwIMeqoLIWzALBgNVHRQEBAICIAQwCgYIKoZIzj0EAwIDSQAwRgIh
-AI0Fl7b1oh6x96i14akYhMMcVHPi7VdLh7fXSf9bMoeqAiEAzxqdobdrD2e53V5b
-0o4HUOCgRB1dzH1m+LcRe+LPUnI=
+MzA5MjcxMjEwMDlaFw0yNjA2MjMxMjEwMDlaoDAwLjAfBgNVHSMEGDAWgBSXHWDD
+hyJZm2AfhLSZHIhNv9oebjALBgNVHRQEBAICIAQwCgYIKoZIzj0EAwIDRwAwRAIg
+C6Wlwom5faQm2pTYRBI2DVTdy7DYv1QYsi/y6ZDhPAQCIEfioB8LqiTO0gjSzUVN
+KPkEXx3y4Ih3HHcrTwWOVuGv
 -----END X509 CRL-----

certs/crl/ca-int.pem

@@ -2,13 +2,13 @@
 MIICHDCCAQQCAQEwDQYJKoZIhvcNAQELBQAwgZ8xCzAJBgNVBAYTAlVTMRMwEQYD
 VQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xm
 U1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEgMB4GA1UEAwwXd29sZlNTTCBJbnRl
-cm1lZGlhdGUgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIw
-MDYxNjE5MTc1OFoXDTIzMDMxMzE5MTc1OFqgMDAuMB8GA1UdIwQYMBaAFIMc8ZiF
-7G4GRTTeUcC6tytnMmZNMAsGA1UdFAQEAgIgADANBgkqhkiG9w0BAQsFAAOCAQEA
-VQ6Am+DuDpBbUs2yEIe0MDwgVZacmOwEB6wZM/c62qW+tGitjUnj1UD6wNQZwYpP
-OGNYOdbiIskilSC97WJgXW4dJVrRHiV8nAzzi/8tZO96oUbLx1hmfx1/hCxqtm50
-bbYUuS25qoiVFKYkx1tocY+ESLfam09T8ZP3m5m38h5YTe+s6dmHdonEM+JlNEdT
-itvZtSfUU29xCQIXVSWFJHsRGjqdvCpndtY1Kmb8aYdB60zpk2JgOGljg2uF7Iq0
-lquWWfhDl77r0qdlRYHTQ+0FetU4gCZ+ZVGH07+FD/p+GxPh4P0D3i2gFq2Z/0en
-396xKNy+NiBbFw/CUFbLDw==
+cm1lZGlhdGUgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIz
+MDkyNzEyMTAwOVoXDTI2MDYyMzEyMTAwOVqgMDAuMB8GA1UdIwQYMBaAFO9p4PfV
+HeaZ7Nxt0PfiuVxkcYM1MAsGA1UdFAQEAgIgADANBgkqhkiG9w0BAQsFAAOCAQEA
+S39FIBb1dxg1cLXT/tg/G5AO96rcOYWz31KoZee1ATTDmgG/Wfl5eZyzqIrj6yNB
+r0itqwEK4rcJRz5CGRPCa81M3VRcQncj908boEuVsaiWzobWYz1TYTFUvnlQpRO3
+Z124+mBucZ+VxiClZqcCfR/0I8tJFMYDltwWtap8VYeIV6qhqKw7EWTPhwG+me18
+jyhclPaq6sHiUBanecQODzrlXsLGgC64E9h0zbFc7xQXrnLWRurfuLA4vY2xoyyj
+xwTcdSLDL4rlqA2dVEx/FrbA1SBjgUrJy4XJthsFIu4M2fiY81cWKQmEC/2q7qPK
+NrGG8b24EkPvFXepUtleJQ==
 -----END X509 CRL-----

certs/crl/ca-int2-ecc.pem

@@ -3,8 +3,8 @@ MIIBYTCCAQYCAQEwCgYIKoZIzj0EAwIwgaQxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
 DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NM
 MRQwEgYDVQQLDAtEZXZlbG9wbWVudDElMCMGA1UEAwwcd29sZlNTTCBJbnRlcm1l
 ZGlhdGUyIENBIEVDQzEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbRcN
-MjAwNjE2MTkxNzU4WhcNMjMwMzEzMTkxNzU4WqAwMC4wHwYDVR0jBBgwFoAUG/S9
-kCh0ZOMzXotkp/yvuvK5VeUwCwYDVR0UBAQCAiAFMAoGCCqGSM49BAMCA0kAMEYC
-IQDBYNHurBS8JV1DkJLVaVXD5lrvjdCA13poIGJxVvx0NwIhALJQRBbMvQCLZ4ci
-sE1dD+cpe4NdK/x2iH4QJ8XJX8uc
+MjMwOTI3MTIxMDA5WhcNMjYwNjIzMTIxMDA5WqAwMC4wHwYDVR0jBBgwFoAUn657
+enCABFUrxrcMW3nkEkFlMSkwCwYDVR0UBAQCAiAFMAoGCCqGSM49BAMCA0kAMEYC
+IQCIZv1TFoij0ezl8/TaA4wq4cNRnYZaKf+W4ROnAfghZwIhALog+BqrxkhP0C3C
+LEWWD4Q7rOIZdNfK8ABwrg+vWneJ
 -----END X509 CRL-----

certs/crl/ca-int2.pem

@@ -3,12 +3,12 @@ MIICHTCCAQUCAQEwDQYJKoZIhvcNAQELBQAwgaAxCzAJBgNVBAYTAlVTMRMwEQYD
 VQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xm
 U1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEhMB8GA1UEAwwYd29sZlNTTCBJbnRl
 cm1lZGlhdGUyIENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0y
-MDA2MTYxOTE3NThaFw0yMzAzMTMxOTE3NThaoDAwLjAfBgNVHSMEGDAWgBR6ix1O
-o0DIzlhfjfz/Rix1QdkDXjALBgNVHRQEBAICIAEwDQYJKoZIhvcNAQELBQADggEB
-AJeG0+IjjS5Rf2gAJu/ldHzCwMJccTKt17mHjyQhQnzOQN8Df+zAUDWIVF99d0vO
-cQFx5SYWpFYkT6kSRYHdYmZp8s6Yl0oQJ+isQ1wsFnkF2z+I/g1f/uDX9LWnKxnj
-UE2UttU6fKGQl2F8SDnloDsQjjGnxssyGVeNCTBGjkCHHH9QSpZv5xjTN7INYCso
-3GkWnXwGkghwleXGtgMwW2IMsNVMIFJlHQQzk9P6gqTtvhkCNp6rjAHieU8GqBkh
-1zCMDTgk2LjFaRF/OnbOk1/j+LZZxox9KUIhUF4d33+PhoUd9YegvJJfdVXAKnVc
-HwoO9FjX3jBcnfvs6qPBKLc=
+MzA5MjcxMjEwMDlaFw0yNjA2MjMxMjEwMDlaoDAwLjAfBgNVHSMEGDAWgBQNyWAg
+Q1iB4Joh72YW3G4hJd8rRTALBgNVHRQEBAICIAEwDQYJKoZIhvcNAQELBQADggEB
+AFZgStFKb9hSbaI7ysWXXDNBNPvb97aHd8A3T4HgYVf6MqlnyI2gJbe5VUYtoJTF
+VTIrfM7tJQf68pGCpCbo6N8ai9xAvfU+AeWk2SHgBFRj2LRprx7tDwt0/Y6YlZ2a
+PHhTqyOLEhrW0Qh6NLOJ3e0zS/GQ7Oy8muPUcBbeq+XkLK2JH6gKVrzjn7QptNDr
+7zEdntQArofx1+twNrn800pdltNjV0etC1Ags5ocg10Xp1dD9NPFdLsY5cASHitP
+xpek4sZiBvEB0YKOs+eY8tYtFAPRzEfz5JeZNwUL3jhLH8/4d0mioVSH1+k0xkBz
+MRdmZc1yQaIQe6U0tgzw9SM=
 -----END X509 CRL-----

certs/crl/client-int-ecc.pem

@@ -1,10 +1,10 @@
 -----BEGIN X509 CRL-----
-MIIBXDCCAQICAQEwCgYIKoZIzj0EAwIwgaAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
+MIIBWzCCAQICAQEwCgYIKoZIzj0EAwIwgaAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
 DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NM
 MRQwEgYDVQQLDAtEZXZlbG9wbWVudDEhMB8GA1UEAwwYd29sZlNTTCBDbGllbnQg
-Q2hhaW4gRUNDMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yMDA2
-MTYxOTE3NThaFw0yMzAzMTMxOTE3NThaoDAwLjAfBgNVHSMEGDAWgBTr1EtZa5Vh
-P1FXtgRNiUGIRFyr8jALBgNVHRQEBAICIAcwCgYIKoZIzj0EAwIDSAAwRQIhAJiz
-His7baFwO9NAwNTMMpNJbYd1XClf1q9lOdO9S/sqAiBfh8Qy7Lri1brEaafDCxe3
-3PgVHR+m9QkJssAuOEIK2A==
+Q2hhaW4gRUNDMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yMzA5
+MjcxMjEwMTBaFw0yNjA2MjMxMjEwMTBaoDAwLjAfBgNVHSMEGDAWgBTr1EtZa5Vh
+P1FXtgRNiUGIRFyr8jALBgNVHRQEBAICIAcwCgYIKoZIzj0EAwIDRwAwRAIgN4x2
+Lb57tlFYEhVyiNJ+7vmlTSn5IgDY2aMbw5bSi+wCIA7KlbvpkAzSA+lKwUD8wmfW
+r4AwiWgQOz5RfhRx1rXC
 -----END X509 CRL-----

certs/crl/client-int.pem

@@ -2,13 +2,13 @@
 MIICGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwgZwxCzAJBgNVBAYTAlVTMRMwEQYD
 VQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xm
 U1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEdMBsGA1UEAwwUd29sZlNTTCBDbGll
-bnQgQ2hhaW4xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIwMDYx
-NjE5MTc1OFoXDTIzMDMxMzE5MTc1OFqgMDAuMB8GA1UdIwQYMBaAFDPYRWbXaIcY
-flQNcCeRxybXhWXAMAsGA1UdFAQEAgIgAzANBgkqhkiG9w0BAQsFAAOCAQEARom6
-mppTxCF+GWAEHFbn9EJee2uCCrQ9dd4JLA1Hc4XYGHOoN54jPKZEvTTYB5XKImCg
-NvbOb98l88Gpr0fUDTuAdBQZrM7Vs3IBPoOJdjMNuwQzxvQ+WdY2Jft/4CaR4/mq
-oMJrmhlz1PmWNTqqfFS/GQv/NYDdCXhP4bNuWRMZoSYROyby+bqr2SgNbZ+0GA3/
-jeSCXmdngwEB7z5SoqqRscVOS7Sw1S3e6X/QNQ6rNNR6MWKH95Ra8ke9A12r+3zu
-ZqbIYtbaF49tvOJsvzKQeC8J2oTzpEbRvNudJ4mXLpNEw5I/RL1sum0bJIn0wL+/
-7q1EaGe14zTsPsx06g==
+bnQgQ2hhaW4xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIzMDky
+NzEyMTAwOVoXDTI2MDYyMzEyMTAwOVqgMDAuMB8GA1UdIwQYMBaAFDPYRWbXaIcY
+flQNcCeRxybXhWXAMAsGA1UdFAQEAgIgAzANBgkqhkiG9w0BAQsFAAOCAQEAquOQ
+8p0OUhEcAy2RKuXz9mJ+/NpBf4O3f4DmIlNjKC+Vm6dkV/wYFI63/trUZ7zOsL2A
+GCDuFtXqcmWJcl6A3Fi2sUqSrwaz+J7n0fRARlvAHNIiSZX02pPYt+zzBxUUdvmp
+VcFyAPs5VTbCGXQEgqPsH2bpeVtDvEqEhS4fv6GtOQ59nOiDMJqHl6iUKAD/Jw4x
+M/eemrpnGS4K2JG/IBmQN8bZ/3pX+4bAymNqaj+Wz0PQxkOvr7Kv+U9M/Jr8QXPz
+zPAZQfPU5caUA+DhGwPK9NNJu07seuUTi7D0qRP28p0k4rOR7AtRmi47KhP1Rxm1
+7aYL9GnvRcuHob7NtQ==
 -----END X509 CRL-----

certs/crl/extra-crls/ca-int-cert-revoked.pem

@@ -0,0 +1,13 @@
+-----BEGIN X509 CRL-----
+MIICBTCB7gIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV
+BAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3Ro
+MRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20x
+HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIzMDkyNzEyMTcyNVoX
+DTI2MDYyMzEyMTcyNVowFTATAgIQABcNMjMwOTI3MTIxNzE2WqAOMAwwCgYDVR0U
+BAMCAQQwDQYJKoZIhvcNAQELBQADggEBAHcmTpTTjLjvxhp88HaQntip35iPTdYb
+RI39Y/DvbDwlyjczvJhhjXmTvDcRLqTkzvdTPFMSVMm+oAYIUdi9RqBwxAZCx1Wf
+4l+WmU8qtz9l1PF3fKU5fsJzlWByPXjyUN6SAa4Uy5k5p4W2HBdXJvKFIY6Q08Cg
+ZHQgwOvHgu3Wh1qCbApNtzPcFv2HLWINg/e/mDAP7dJALNSld4HQ86oT9fB70sWI
+w9ogw18ARxX1M+piZ9oH02bO7K5KMnIeSalen0eXgA/O62+pBF1BvQ7fzmqEUyrp
+OkSYet+pv5bij8IK302z4Ukx/cU8dIDYTNfG+/12YVVFrKL1CnQ20mE=
+-----END X509 CRL-----

certs/crl/gencrls.sh

@@ -107,17 +107,25 @@ check_result $?
 # remove revoked so next time through the normal CA won't have server revoked
 cp blank.index.txt demoCA/index.txt
 
+echo "Step 12"
+# revoke an intermediate cert
+openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../intermediate/ca-int-cert.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem
+openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out extra-crls/ca-int-cert-revoked.pem -keyfile ../ca-key.pem -cert ../ca-cert.pem
+
+# remove revoked so next time through the normal CA won't have server revoked
+cp blank.index.txt demoCA/index.txt
+
 # caEccCrl
-echo "Step 10"
+echo "Step 13"
 openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../server-revoked-cert.pem -keyfile ../ca-ecc-key.pem -cert ../ca-ecc-cert.pem
 check_result $?
 
-echo "Step 11"
+echo "Step 14"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out caEccCrl.pem -keyfile ../ca-ecc-key.pem -cert ../ca-ecc-cert.pem
 check_result $?
 
 # metadata
-echo "Step 13"
+echo "Step 15"
 openssl crl -in caEccCrl.pem -text > tmp
 check_result $?
 mv tmp caEccCrl.pem
@@ -128,69 +136,69 @@ mv tmp caEccCrl.pem
 # server-revoked-cert.pem is already revoked in Step 10
 #openssl ca -config ../renewcerts/wolfssl.cnf -revoke ../server-revoked-cert.pem -keyfile ../ca-ecc384-key.pem -cert ../ca-ecc384-cert.pem
 
-echo "Step 14"
+echo "Step 16"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out caEcc384Crl.pem -keyfile ../ca-ecc384-key.pem -cert ../ca-ecc384-cert.pem
 check_result $?
 
 # metadata
-echo "Step 15"
+echo "Step 17"
 openssl crl -in caEcc384Crl.pem -text > tmp
 check_result $?
 mv tmp caEcc384Crl.pem
 # install (only needed if working outside wolfssl)
 #cp caEcc384Crl.pem ~/wolfssl/certs/crl/caEcc384Crl.pem
 
 # cliCrl
-echo "Step 16"
+echo "Step 18"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out cliCrl.pem -keyfile ../client-key.pem -cert ../client-cert.pem
 check_result $?
 
 # metadata
-echo "Step 17"
+echo "Step 19"
 openssl crl -in cliCrl.pem -text > tmp
 check_result $?
 mv tmp cliCrl.pem
 # install (only needed if working outside wolfssl)
 #cp cliCrl.pem ~/wolfssl/certs/crl/cliCrl.pem
 
 # eccCliCRL
-echo "Step 18"
+echo "Step 20"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out eccCliCRL.pem -keyfile ../ecc-client-key.pem -cert ../client-ecc-cert.pem
 check_result $?
 
 # metadata
-echo "Step 19"
+echo "Step 21"
 openssl crl -in eccCliCRL.pem -text > tmp
 check_result $?
 mv tmp eccCliCRL.pem
 # install (only needed if working outside wolfssl)
 #cp eccCliCRL.pem ~/wolfssl/certs/crl/eccCliCRL.pem
 
 # eccSrvCRL
-echo "Step 20"
+echo "Step 22"
 openssl ca -config ../renewcerts/wolfssl.cnf -gencrl -crldays 1000 -out eccSrvCRL.pem -keyfile ../ecc-key.pem -cert ../server-ecc.pem
 check_result $?
 
 # metadata
-echo "Step 21"
+echo "Step 23"
 openssl crl -in eccSrvCRL.pem -text > tmp
 check_result $?
 mv tmp eccSrvCRL.pem
 # install (only needed if working outside wolfssl)
 #cp eccSrvCRL.pem ~/wolfssl/certs/crl/eccSrvCRL.pem
 
 # caEccCrl
-echo "Step 22"
+echo "Step 24"
 openssl ca -config ./wolfssl.cnf -gencrl -crldays 1000 -out caEccCrl.pem -keyfile ../ca-ecc-key.pem -cert ../ca-ecc-cert.pem
 check_result $?
 
 # ca-ecc384-cert
-echo "Step 23"
+echo "Step 25"
 openssl ca -config ./wolfssl.cnf -gencrl -crldays 1000 -out caEcc384Crl.pem -keyfile ../ca-ecc384-key.pem -cert ../ca-ecc384-cert.pem
 check_result $?
 
 # create crl and crl2 der files for unit test
-echo "Step 24"
+echo "Step 26"
 openssl crl -in crl.pem -inform PEM -out crl.der -outform DER
 openssl crl -in crl2.pem -inform PEM -out crl2.der -outform DER
 

certs/crl/include.am

@@ -3,30 +3,32 @@
 #
 
 EXTRA_DIST += \
-	     certs/crl/hash_pem/0fdb2da4.r0 \
-	     certs/crl/hash_der/0fdb2da4.r0 \
-	     certs/crl/crl.pem \
-	     certs/crl/cliCrl.pem \
-	     certs/crl/eccSrvCRL.pem \
-	     certs/crl/eccCliCRL.pem \
-	     certs/crl/crl2.pem \
-	     certs/crl/caEccCrl.der \
-	     certs/crl/caEccCrl.pem \
-	     certs/crl/caEcc384Crl.pem \
-	     certs/crl/wolfssl.cnf \
-	     certs/crl/crl.der \
-	     certs/crl/crl2.der
+		certs/crl/hash_pem/0fdb2da4.r0 \
+		certs/crl/hash_der/0fdb2da4.r0 \
+		certs/crl/crl.pem \
+		certs/crl/cliCrl.pem \
+		certs/crl/eccSrvCRL.pem \
+		certs/crl/eccCliCRL.pem \
+		certs/crl/crl2.pem \
+		certs/crl/caEccCrl.der \
+		certs/crl/caEccCrl.pem \
+		certs/crl/caEcc384Crl.pem \
+		certs/crl/wolfssl.cnf \
+		certs/crl/crl.der \
+		certs/crl/crl2.der
 
 EXTRA_DIST += \
-	     certs/crl/crl.revoked
+		certs/crl/crl.revoked \
+		certs/crl/extra-crls/ca-int-cert-revoked.pem \
+		certs/crl/extra-crls/general-server-crl.pem
 
 # Intermediate cert CRL's
 EXTRA_DIST += \
-		 certs/crl/ca-int.pem \
-		 certs/crl/ca-int2.pem \
-		 certs/crl/client-int.pem \
-	     certs/crl/server-int.pem \
-	     certs/crl/ca-int-ecc.pem \
-		 certs/crl/ca-int2-ecc.pem \
-		 certs/crl/client-int-ecc.pem \
-	     certs/crl/server-int-ecc.pem
+		certs/crl/ca-int.pem \
+		certs/crl/ca-int2.pem \
+		certs/crl/client-int.pem \
+		certs/crl/server-int.pem \
+		certs/crl/ca-int-ecc.pem \
+		certs/crl/ca-int2-ecc.pem \
+		certs/crl/client-int-ecc.pem \
+		certs/crl/server-int-ecc.pem

certs/crl/server-int-ecc.pem

@@ -1,10 +1,10 @@
 -----BEGIN X509 CRL-----
-MIIBXDCCAQICAQEwCgYIKoZIzj0EAwIwgaAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
+MIIBXTCCAQICAQEwCgYIKoZIzj0EAwIwgaAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
 DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NM
 MRQwEgYDVQQLDAtEZXZlbG9wbWVudDEhMB8GA1UEAwwYd29sZlNTTCBTZXJ2ZXIg
-Q2hhaW4gRUNDMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yMDA2
-MTYxOTE3NThaFw0yMzAzMTMxOTE3NThaoDAwLjAfBgNVHSMEGDAWgBRdXSbvrH42
-+Zt2FStKJQIj77KJMDALBgNVHRQEBAICIAYwCgYIKoZIzj0EAwIDSAAwRQIgeQwr
-cMQD2CE83QHYP6QoAqN3FlxOmPC9f4QQVlpOozUCIQDTDxH4UsFLCy8QgtjtfkFC
-TmVI1ubZPFDiRHGDWI2LaA==
+Q2hhaW4gRUNDMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tFw0yMzA5
+MjcxMjEwMDlaFw0yNjA2MjMxMjEwMDlaoDAwLjAfBgNVHSMEGDAWgBRdXSbvrH42
++Zt2FStKJQIj77KJMDALBgNVHRQEBAICIAYwCgYIKoZIzj0EAwIDSQAwRgIhAMfw
+Zdxg+ZHfkUB2CGl10FTK07QsadcvaWfPTm9DR+HKAiEA05BIg3SELG8Y3y5cpZ7o
+MoDq1dISrrjXFSoDE94DUeM=
 -----END X509 CRL-----

certs/crl/server-int.pem

@@ -2,13 +2,13 @@
 MIICGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwgZwxCzAJBgNVBAYTAlVTMRMwEQYD
 VQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xm
 U1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEdMBsGA1UEAwwUd29sZlNTTCBTZXJ2
-ZXIgQ2hhaW4xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIwMDYx
-NjE5MTc1OFoXDTIzMDMxMzE5MTc1OFqgMDAuMB8GA1UdIwQYMBaAFLMRMsmSmITi
-yfjQO24DQsofDo48MAsGA1UdFAQEAgIgAjANBgkqhkiG9w0BAQsFAAOCAQEAtEEG
-Z05j/ygGi+DNPkjevKDcZlkPYRcYMQpM1RTkVyzbO6YG1i0ZoCH1MKBxB0MPS3xa
-qb96jYIfpDZOUb/o2ZXOefXcirm53eJTSoa72dFoxawH74J1f/HgRT8UYISvJ+1a
-L4NtAcn3lNxZWtg0gvT0pdy1zCpEsxonz4mJEaN5796qIUj1z47r/D0P9w8TFshC
-9Kow+FNEjZT7A8E9EAdfePTlws8FXNcJEUbyxEJUOe6QTssXr4Ib20opQKREvhfY
-5S6MsQibpO/EEv+Tg5JYeqjWOpqfO/gKBo4Xa9ImbC8N1OdCkd0ZHqvcC8IC6S00
-V0/Td56mV5BZJXG0pw==
+ZXIgQ2hhaW4xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIzMDky
+NzEyMTAwOVoXDTI2MDYyMzEyMTAwOVqgMDAuMB8GA1UdIwQYMBaAFLMRMsmSmITi
+yfjQO24DQsofDo48MAsGA1UdFAQEAgIgAjANBgkqhkiG9w0BAQsFAAOCAQEACBCr
+TAzAlmfF6tnhf/P5l+tg9Jd/J3SB0vNw8Pw5yQcb0/mCkYNfdjCGGp9KqiToeS1G
+uhKW5oENKY/n3CsXXBnRfhAHtwUyxrzjuc4iPF8ymgwlHGjlr/74a2CYu2iXTIIM
+2P37m1p+u5FhcyH+qncgR6I6n4FeIZFSz4aXHeruTVEDliUshWC4PVpkqokk1u5/
+V2RUYTiPGyxrlpRIFtTPbnRcwItmmtPrq6YO20soDPvjtjFOgGzlP31QzVSpP7wU
+O/z9Thzw0CBckJN3DZIQqGJd5GkmOw63KD0auf1FrtjuFY64OEU4+LsZwwQO6aVD
+nSKMhOpc5T6VumKS8w==
 -----END X509 CRL-----