[PATCH applied] Re: ssl_openssl: Fix some CRL mixups

So, finally.  Thanks for helping us fix our OpenSSL interfacing code :-)

It took a bit, because of this and that, and releases getting in the
way, and then finding a second pair of eyes to review the adjustments
Arne did.  But now we have nice code that makes buildbot and my local
tests happy (which do not use CRLs... but that should be somewhat
easy to add to the CI testing - create a dedicated client cert that
is then revoked right away, file that under "must fail" t_client tests).

Your patch has been applied to the master and release/2.7 branch
(long-term compat with OpenSSL 4.0).

I'm not sure about 2.6 - it's not a "hard bug" as the existing code
sort-of-works, and 2.6 will never see OpenSSL 4.0 compat fixes now
that 2.7 is the main release under maintenance.  So I went for "not
needed, and only real bugfixes go to 2.6 now".  Further, it wouldn't
work as is anyway (gerrit 1431 is not in 2.6)...

commit 2befad4de1b4da3c06c5fb3537a767ac1d058eb3 (master)
commit 0588668f4d12f6a1b87f1cf94f4d8ee96cadbf26 (release/2.7)
Author: David Benjamin
Date:   Thu Apr 16 19:41:35 2026 +0200

     ssl_openssl: Fix some CRL mixups

     Signed-off-by: David Benjamin <[email protected]>
     Signed-off-by: Arne Schwabe <[email protected]>
     Acked-by: Arne Schwabe <[email protected]>
     Acked-by: MaxF <[email protected]>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1289
     Message-Id: <[email protected]>
     URL: https://www.mail-archive.com/[email protected]/msg36641.html
     Signed-off-by: Gert Doering <[email protected]>


--
kind regards,

Gert Doering