Kai Engert (:KaiE:) Reporter
	Description • 14 years ago

libPKIX should permanently store each CRLs it downloads

The permanent NSS database might have limitations, and might not be able to store all variants of CRLs. (partitioned? partial?)

The PKIX should make sure it imports only those who can be managed by CRLs.
At this time it might only support "full CRLs".

	Kai Engert (:KaiE:) Reporter
	Comment 1 • 14 years ago

This patch works for me.

However, it has the following problems:

- it doesn't check whether the CRL is valid,
  doesn't check that it has a valid signature

  PSM does check that.
  Function SEC_NewCrl requires that the CRL has been checked before import.

  I wonder where PKIX is doing that check currently.
  Couldn't find it yet.

- we probably need to free the object returned by SEC_NewCrl ?
  using SEC_DestroyCrl() ?

	Nelson Bolyard (seldom reads bugmail)
	Comment 2 • 14 years ago

This bug is a dupe of a much older one, IINM