xmlSecDSigCtxVerify ignores expired CRL

Hello,

I found a strange behaviour in management of CRLs (IMHO)

Suppose I use a valid CRL and I verify a signature with a revoked 
certificate : xmlSecDSigCtxVerify() succeeded and status == 
xmlSecDSigStatusInvalid : Well all is fine !
A few days later, (the same CRL has expired), I retry the same operation 
with the same signature : this time the verification succeeds !

In fact, xmlSecOpenSSLX509VerifyCertAgainstCrls() checks the validity of 
CRL.
If the CRL is out of date, the function returns 1 (not revoked), and the 
process of verification is not aborted

(cf. x509vfy.c/xmlSecOpenSSLX509VerifyCertAgainstCrls)
     /*
      * Check date of CRL to make sure it's not expired
      */
     ret = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl));
     if (ret == 0) {
     /* crl expired */
     return(1);
     }

I expected a different behavior ...

1/ If I try to use a expired CRL, when I add this CRL, 
xmlSecOpenSSLX509StoreAdoptCrl() emits a warning or a error.
(this is a bit drastic)

or

2/ If I try to use a expired CRL, 
xmlSecOpenSSLX509VerifyCertAgainstCrls() must use this CRL even if the 
CRL has expired (a revoked certificate remains a revoked certificate) 
and the result of the signature verification will be "invalid"

Your opinion ?
_______________________________________________
xmlsec mailing list
[email protected]
http://www.aleksey.com/mailman/listinfo/xmlsec