482910 - crlutil incomplete

Status: NEW

(NSS :: Tools, enhancement, P5)

Description

[Nelson Bolyard (seldom reads bugmail)]

As noted in Bug 482789,
- crlutil also only prints one CRL, even if there are multiple certs with 
the same nickname, each with a different subject key ID and different CRL.
- crlutil -L -n nickname    doesn't print the complete CRL
- crlutil -L -n nickname    doesn't print all the info that we have stored
with the CRL.  For example, it does not print the URL. 
- crlutil doesn't seem to offer any way to export CRLs from the cert DB

These things really slow down diagnosis of CRL related problems.

Comment 1

[Julien Pierre]

1) our softoken can only store a single CRL per issuer, regardless of subject key ID.

So, it somewhat makes sense for display only one CRL, since usually at most one can be found. The only exception is if CRLs for the same subject are stored in more than one slot/token.

2) What do you mean that crlutil -L -n nickname doesn't print the complete CRL ? What information is missing ?

3-4) It is true that it doesn't have a way to print the URL or export the binary CRL.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

(In reply to comment #1)
> 1) our softoken can only store a single CRL per issuer, regardless of 
> subject key ID. So, it somewhat makes sense for display only one CRL, 
> since usually at most one can be found. 

That's a big problem, but it's obviously not merely a crlutil problem.

> 2) What do you mean that crlutil -L -n nickname doesn't print the complete CRL
> ? What information is missing ?

Information about the signature, for one thing.  The data outside of the 
ToBeSigned component.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.