if ((issuer->ex_flags & EXFLAG_KUSAGE) && !(issuer->ex_kusage & KU_CRL_SIGN)) { ctx->error = X509_V_ERR_KEYUSAGE_NO_CRL_SIGN; ok = ctx->verify_cb(0, ctx); if(!ok) goto err; }
static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)	{	X509 *issuer = NULL;	EVP_PKEY *ikey = NULL;	int ok = 0, chnum, cnum, i;	time_t *ptime;	cnum = ctx->error_depth;	chnum = sk_X509_num(ctx->chain) - 1;	/* Find CRL issuer: if not last certificate then issuer	 * is next certificate in chain.	 */	if(cnum < chnum)		issuer = sk_X509_value(ctx->chain, cnum + 1);	else		{		issuer = sk_X509_value(ctx->chain, chnum);		/* If not self signed, can't check signature */		if(!ctx->check_issued(ctx, issuer, issuer))			{			ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER;			ok = ctx->verify_cb(0, ctx);			if(!ok) goto err;			}		}	if(issuer)		{		/* Attempt to get issuer certificate public key */		ikey = X509_get_pubkey(issuer);		if(!ikey)			{			ctx->error=X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;			ok = ctx->verify_cb(0, ctx);			if (!ok) goto err;			}		else			{			/* Verify CRL signature */			if(X509_CRL_verify(crl, ikey) <= 0)				{				ctx->error=X509_V_ERR_CRL_SIGNATURE_FAILURE;				ok = ctx->verify_cb(0, ctx);				if (!ok) goto err;				}			}		}	/* OK, CRL signature valid check times */	if (ctx->flags & X509_V_FLAG_USE_CHECK_TIME)		ptime = &ctx->check_time;	else		ptime = NULL;	i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);	if (i == 0)		{		ctx->error=X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;		ok = ctx->verify_cb(0, ctx);		if (!ok) goto err;		}	if (i > 0)		{		ctx->error=X509_V_ERR_CRL_NOT_YET_VALID;		ok = ctx->verify_cb(0, ctx);		if (!ok) goto err;		}	if(X509_CRL_get_nextUpdate(crl))		{		i=X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);		if (i == 0)			{			ctx->error=X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;			ok = ctx->verify_cb(0, ctx);			if (!ok) goto err;			}		if (i < 0)			{			ctx->error=X509_V_ERR_CRL_HAS_EXPIRED;			ok = ctx->verify_cb(0, ctx);			if (!ok) goto err;			}		}	ok = 1;	err:	EVP_PKEY_free(ikey);	return ok;	}