Merge branch 'hans/ssl/add_pull_req_crl_fixes/OTP-11761'

* hans/ssl/add_pull_req_crl_fixes/OTP-11761:
  ssl, pubkey: Code and test adjustments
  Rework IDP validation according to the RFC, fix public_key tests
  Various improvements to CRL handling

6 files changed, 856 insertions, 184 deletions

diff --git a/lib/public_key/src/pubkey_cert.erl b/lib/public_key/src/pubkey_cert.erl
index d9288e99bb..ae517ca642 100644
--- a/lib/public_key/src/pubkey_cert.erl
+++ b/lib/public_key/src/pubkey_cert.erl
@@ -319,6 +319,8 @@ verify_fun(Otpcert, Result, UserState0, VerifyFun) ->
 %%
 %% Description: Extracts a specific extension from a list of extensions.
 %%--------------------------------------------------------------------
+select_extension(_, asn1_NOVALUE) ->
+    undefined;
 select_extension(_, []) ->
     undefined;
 select_extension(Id, [#'Extension'{extnID = Id} = Extension | _]) ->
@@ -342,8 +344,11 @@ match_name(uniformResourceIdentifier, URI,  [PermittedName | Rest]) ->
 	incomplete ->
 	    false;
 	{_, _, Host, _, _} ->
-	    match_name(fun is_valid_host_or_domain/2, Host,
-		       PermittedName, Rest)
+	    PN = case split_uri(PermittedName) of
+		     {_, _, PNhost, _, _} -> PNhost;
+		     _X -> PermittedName
+		 end,
+	    match_name(fun is_valid_host_or_domain/2, Host, PN, Rest)
     end;
 
 match_name(emailAddress, Name, [PermittedName | Rest]) ->
diff --git a/lib/public_key/src/pubkey_crl.erl b/lib/public_key/src/pubkey_crl.erl
index eaba5bfa1b..f0df4bc3f2 100644
--- a/lib/public_key/src/pubkey_crl.erl
+++ b/lib/public_key/src/pubkey_crl.erl
@@ -39,7 +39,13 @@ validate(OtpCert, OtherDPCRLs, DP, {DerCRL, CRL}, {DerDeltaCRL, DeltaCRL},
 		CertIssuer = TBSCert#'OTPTBSCertificate'.issuer,
 		TBSCRL = CRL#'CertificateList'.tbsCertList,
 		CRLIssuer =  TBSCRL#'TBSCertList'.issuer,
-		AltNames = subject_alt_names(TBSCert#'OTPTBSCertificate'.extensions),
+		AltNames = case pubkey_cert:select_extension(?'id-ce-subjectAltName',
+							     TBSCert#'OTPTBSCertificate'.extensions) of
+			     undefined ->
+				[];
+			     Ext ->
+				Ext#'Extension'.extnValue
+			   end,
 		revoked_status(DP, IDP, {directoryName, CRLIssuer},
 			       [ {directoryName, CertIssuer} | AltNames], SerialNumber, Revoked,
 			       DeltaRevoked, RevokedState1);
@@ -397,16 +403,18 @@ verify_dp_name(IDPNames, DPorIssuerNames) ->
 match_one([], _) ->
     false;
 match_one([{Type, Name} | Names], CandidateNames) ->
-    Candidates = [NameName || {NameType, NameName} <- CandidateNames, NameType == Type],
+    Candidates = [NameName || {NameType, NameName} <- CandidateNames, 
+			      NameType == Type],
     case Candidates of
 	[] ->
 	    false;
-	[_|_] -> case pubkey_cert:match_name(Type, Name, Candidates) of
-		     true ->
-			 true;
-		 false ->
-			 match_one(Names, CandidateNames)
-		 end
+	[_|_] ->
+	    case pubkey_cert:match_name(Type, Name, Candidates) of
+		true ->
+		    true;
+		false ->
+		    match_one(Names, CandidateNames)
+	    end
     end.
 
 verify_dp_bools(TBSCert, IDP) ->
@@ -664,6 +672,8 @@ verify_extensions([#'TBSCertList_revokedCertificates_SEQOF'{crlEntryExtensions =
     verify_extensions(pubkey_cert:extensions_list(Ext)) and verify_extensions(Rest);
 verify_extensions([]) ->
     true;
+verify_extensions(asn1_NOVALUE) ->
+    true;
 verify_extensions([#'Extension'{critical = true, extnID = Id} | Rest]) ->
     case lists:member(Id, [?'id-ce-authorityKeyIdentifier',
 			   ?'id-ce-issuerAltName',
@@ -689,13 +699,3 @@ authority_key_identifier(Extensions) ->
     Enc = extension_value(?'id-ce-authorityKeyIdentifier',
 			  'AuthorityKeyIdentifier', Extensions),
     pubkey_cert_records:transform(Enc, decode).
-
-subject_alt_names(Extensions) ->
-    Enc = extension_value(?'id-ce-subjectAltName',
-			  'GeneralNames', Extensions),
-    case Enc of
-	undefined ->
-	    [];
-	_ ->
-	    pubkey_cert_records:transform(Enc, decode)
-    end.
diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index 244eb5ce0a..2f8ff6f04e 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -39,6 +39,7 @@ MODULES = \
 	ssl_basic_SUITE \
 	ssl_cipher_SUITE \
 	ssl_certificate_verify_SUITE\
+	ssl_crl_SUITE\
 	ssl_dist_SUITE \
 	ssl_handshake_SUITE \
 	ssl_npn_hello_SUITE \
diff --git a/lib/ssl/test/make_certs.erl b/lib/ssl/test/make_certs.erl
index 4603a9f846..c438ae2b87 100644
--- a/lib/ssl/test/make_certs.erl
+++ b/lib/ssl/test/make_certs.erl
@@ -18,23 +18,68 @@
 %%
 
 -module(make_certs).
+-compile([export_all]).
 
--export([all/2]).
+%-export([all/1, all/2, rootCA/2, intermediateCA/3, endusers/3, enduser/3, revoke/3, gencrl/2, verify/3]).
 
--record(dn, {commonName, 
+-record(config, {commonName, 
 	     organizationalUnitName = "Erlang OTP",
 	     organizationName = "Ericsson AB",
 	     localityName = "Stockholm",
 	     countryName = "SE",
-	     emailAddress = "[email protected]"}).
+	     emailAddress = "[email protected]",
+	     default_bits = 2048,
+	     v2_crls = true,
+	     ecc_certs = false,
+	     issuing_distribution_point = false,
+	     openssl_cmd = "openssl"}).
+
+
+default_config() ->
+    #config{}.
+
+make_config(Args) ->
+    make_config(Args, #config{}).
+
+make_config([], C) ->
+    C;
+make_config([{organizationalUnitName, Name}|T], C) when is_list(Name) ->
+    make_config(T, C#config{organizationalUnitName = Name});
+make_config([{organizationName, Name}|T], C) when is_list(Name) ->
+    make_config(T, C#config{organizationName = Name});
+make_config([{localityName, Name}|T], C) when is_list(Name) ->
+    make_config(T, C#config{localityName = Name});
+make_config([{countryName, Name}|T], C) when is_list(Name) ->
+    make_config(T, C#config{countryName = Name});
+make_config([{emailAddress, Name}|T], C) when is_list(Name) ->
+    make_config(T, C#config{emailAddress = Name});
+make_config([{default_bits, Bits}|T], C) when is_integer(Bits) ->
+    make_config(T, C#config{default_bits = Bits});
+make_config([{v2_crls, Bool}|T], C) when is_boolean(Bool) ->
+    make_config(T, C#config{v2_crls = Bool});
+make_config([{ecc_certs, Bool}|T], C) when is_boolean(Bool) ->
+    make_config(T, C#config{ecc_certs = Bool});
+make_config([{issuing_distribution_point, Bool}|T], C) when is_boolean(Bool) ->
+    make_config(T, C#config{issuing_distribution_point = Bool});
+make_config([{openssl_cmd, Cmd}|T], C) when is_list(Cmd) ->
+    make_config(T, C#config{openssl_cmd = Cmd}).
+
+
+all([DataDir, PrivDir]) ->
+    all(DataDir, PrivDir).
 
 all(DataDir, PrivDir) ->
-    OpenSSLCmd = "openssl",
+    all(DataDir, PrivDir, #config{}).
+
+all(DataDir, PrivDir, C) when is_list(C) ->
+    all(DataDir, PrivDir, make_config(C));
+all(DataDir, PrivDir, C = #config{}) ->
+    ok = filelib:ensure_dir(filename:join(PrivDir, "erlangCA")),
     create_rnd(DataDir, PrivDir),			% For all requests
-    rootCA(PrivDir, OpenSSLCmd, "erlangCA"),
-    intermediateCA(PrivDir, OpenSSLCmd, "otpCA", "erlangCA"),
-    endusers(PrivDir, OpenSSLCmd, "otpCA", ["client", "server"]),
-    collect_certs(PrivDir, ["erlangCA", "otpCA"], ["client", "server"]),
+    rootCA(PrivDir, "erlangCA", C),
+    intermediateCA(PrivDir, "otpCA", "erlangCA", C),
+    endusers(PrivDir, "otpCA", ["client", "server", "revoked"], C),
+    endusers(PrivDir, "erlangCA", ["localhost"], C),
     %% Create keycert files 
     SDir = filename:join([PrivDir, "server"]),
     SC = filename:join([SDir, "cert.pem"]),
@@ -46,7 +91,14 @@ all(DataDir, PrivDir) ->
     CK = filename:join([CDir, "key.pem"]),
     CKC = filename:join([CDir, "keycert.pem"]),
     append_files([CK, CC], CKC),
-    remove_rnd(PrivDir).
+    RDir = filename:join([PrivDir, "revoked"]),
+    RC = filename:join([RDir, "cert.pem"]),
+    RK = filename:join([RDir, "key.pem"]),
+    RKC = filename:join([RDir, "keycert.pem"]),
+    revoke(PrivDir, "otpCA", "revoked", C),
+    append_files([RK, RC], RKC),
+    remove_rnd(PrivDir),
+    {ok, C}.
 
 append_files(FileNames, ResultFileName) ->
     {ok, ResultFile} = file:open(ResultFileName, [write]),
@@ -59,111 +111,176 @@ do_append_files([F|Fs], RF) ->
     ok = file:write(RF, Data),
     do_append_files(Fs, RF).
 
-rootCA(Root, OpenSSLCmd, Name) ->
-    create_ca_dir(Root, Name, ca_cnf(Name)),
-    DN = #dn{commonName = Name},
-    create_self_signed_cert(Root, OpenSSLCmd, Name, req_cnf(DN)),
-    ok.
+rootCA(Root, Name, C) ->
+    create_ca_dir(Root, Name, ca_cnf(C#config{commonName = Name})),
+    create_self_signed_cert(Root, Name, req_cnf(C#config{commonName = Name}), C),
+    file:copy(filename:join([Root, Name, "cert.pem"]), filename:join([Root, Name, "cacerts.pem"])),
+    gencrl(Root, Name, C).
 
-intermediateCA(Root, OpenSSLCmd, CA, ParentCA) ->
-    CA = "otpCA", 
-    create_ca_dir(Root, CA, ca_cnf(CA)),
+intermediateCA(Root, CA, ParentCA, C) ->
+    create_ca_dir(Root, CA, ca_cnf(C#config{commonName = CA})),
     CARoot = filename:join([Root, CA]),
-    DN = #dn{commonName = CA},
     CnfFile = filename:join([CARoot, "req.cnf"]),
-    file:write_file(CnfFile, req_cnf(DN)),
+    file:write_file(CnfFile, req_cnf(C#config{commonName = CA})),
     KeyFile = filename:join([CARoot, "private", "key.pem"]), 
     ReqFile =  filename:join([CARoot, "req.pem"]), 
-    create_req(Root, OpenSSLCmd, CnfFile, KeyFile, ReqFile),
+    create_req(Root, CnfFile, KeyFile, ReqFile, C),
     CertFile = filename:join([CARoot, "cert.pem"]),
-    sign_req(Root, OpenSSLCmd, ParentCA, "ca_cert", ReqFile, CertFile).
-
-endusers(Root, OpenSSLCmd, CA, Users) ->
-    lists:foreach(fun(User) -> enduser(Root, OpenSSLCmd, CA, User) end, Users).
-
-enduser(Root, OpenSSLCmd, CA, User) -> 
+    sign_req(Root, ParentCA, "ca_cert", ReqFile, CertFile, C),
+    CACertsFile = filename:join(CARoot, "cacerts.pem"),
+    file:copy(filename:join([Root, ParentCA, "cacerts.pem"]), CACertsFile),
+    %% append this CA's cert to the cacerts file
+    {ok, Bin} = file:read_file(CertFile),
+    {ok, FD} = file:open(CACertsFile, [append]),
+    file:write(FD, ["\n", Bin]),
+    file:close(FD),
+    gencrl(Root, CA, C).
+
+endusers(Root, CA, Users, C) ->
+    [enduser(Root, CA, User, C) || User <- Users].
+
+enduser(Root, CA, User, C) ->
     UsrRoot = filename:join([Root, User]),
     file:make_dir(UsrRoot),
     CnfFile = filename:join([UsrRoot, "req.cnf"]),
-    DN = #dn{commonName = User},
-    file:write_file(CnfFile, req_cnf(DN)),
+    file:write_file(CnfFile, req_cnf(C#config{commonName = User})),
     KeyFile = filename:join([UsrRoot, "key.pem"]), 
     ReqFile =  filename:join([UsrRoot, "req.pem"]), 
-    create_req(Root, OpenSSLCmd, CnfFile, KeyFile, ReqFile),
+    create_req(Root, CnfFile, KeyFile, ReqFile, C),
+    %create_req(Root, CnfFile, KeyFile, ReqFile),
     CertFileAllUsage =  filename:join([UsrRoot, "cert.pem"]),
-    sign_req(Root, OpenSSLCmd, CA, "user_cert", ReqFile, CertFileAllUsage),
+    sign_req(Root, CA, "user_cert", ReqFile, CertFileAllUsage, C),
     CertFileDigitalSigOnly =  filename:join([UsrRoot, "digital_signature_only_cert.pem"]),
-    sign_req(Root, OpenSSLCmd, CA, "user_cert_digital_signature_only", ReqFile, CertFileDigitalSigOnly).
-
-collect_certs(Root, CAs, Users) ->
-    Bins = lists:foldr(
-	     fun(CA, Acc) -> 
-		     File = filename:join([Root, CA, "cert.pem"]),
-		     {ok, Bin} = file:read_file(File),
-		     [Bin, "\n" | Acc]
-	     end, [], CAs),
-    lists:foreach(
-      fun(User) ->
-	      File = filename:join([Root, User, "cacerts.pem"]),
-	      file:write_file(File, Bins)
-      end, Users).
+    sign_req(Root, CA, "user_cert_digital_signature_only", ReqFile, CertFileDigitalSigOnly, C),
+    CACertsFile = filename:join(UsrRoot, "cacerts.pem"),
+    file:copy(filename:join([Root, CA, "cacerts.pem"]), CACertsFile),
+    ok.
+
+revoke(Root, CA, User, C) ->
+    UsrCert = filename:join([Root, User, "cert.pem"]),
+    CACnfFile = filename:join([Root, CA, "ca.cnf"]),
+    Cmd = [C#config.openssl_cmd, " ca"
+	   " -revoke ", UsrCert,
+	   [" -crl_reason keyCompromise" || C#config.v2_crls ],
+	   " -config ", CACnfFile],
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
+    cmd(Cmd, Env),
+    gencrl(Root, CA, C).
+
+gencrl(Root, CA, C) ->
+    CACnfFile = filename:join([Root, CA, "ca.cnf"]),
+    CACRLFile = filename:join([Root, CA, "crl.pem"]),
+    Cmd = [C#config.openssl_cmd, " ca"
+	   " -gencrl ",
+	   " -crlhours 24",
+	   " -out ", CACRLFile,
+	   " -config ", CACnfFile],
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
+    cmd(Cmd, Env).
 
-create_self_signed_cert(Root, OpenSSLCmd, CAName, Cnf) ->
+verify(Root, CA, User, C) ->
+    CAFile = filename:join([Root, User, "cacerts.pem"]),
+    CACRLFile = filename:join([Root, CA, "crl.pem"]),
+    CertFile = filename:join([Root, User, "cert.pem"]),
+    Cmd = [C#config.openssl_cmd, " verify"
+	   " -CAfile ", CAFile,
+	   " -CRLfile ", CACRLFile, %% this is undocumented, but seems to work
+	   " -crl_check ",
+	   CertFile],
+    Env = [{"ROOTDIR", filename:absname(Root)}],
+    try cmd(Cmd, Env) catch
+	   exit:{eval_cmd, _, _} ->
+		invalid
+    end.
+
+create_self_signed_cert(Root, CAName, Cnf, C = #config{ecc_certs = true}) ->
     CARoot = filename:join([Root, CAName]),
     CnfFile = filename:join([CARoot, "req.cnf"]),
     file:write_file(CnfFile, Cnf),
     KeyFile = filename:join([CARoot, "private", "key.pem"]), 
     CertFile = filename:join([CARoot, "cert.pem"]), 
-    Cmd = [OpenSSLCmd, " req"
+    Cmd = [C#config.openssl_cmd, " ecparam"
+	   " -out ", KeyFile,
+	   " -name secp521r1 ",
+	   %" -name sect283k1 ",
+	   " -genkey "],
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
+    cmd(Cmd, Env),
+
+    Cmd2 = [C#config.openssl_cmd, " req"
 	   " -new"
 	   " -x509"
 	   " -config ", CnfFile,
-	   " -keyout ", KeyFile, 
+	   " -key ", KeyFile, 
+		 " -outform PEM ",
 	   " -out ", CertFile], 
-    Env = [{"ROOTDIR", Root}],  
-    cmd(Cmd, Env),
-    fix_key_file(OpenSSLCmd, KeyFile).
-
-% openssl 1.0 generates key files in pkcs8 format by default and we don't handle this format
-fix_key_file(OpenSSLCmd, KeyFile) ->
-    KeyFileTmp = KeyFile ++ ".tmp",
-    Cmd = [OpenSSLCmd, " rsa",
-           " -in ",
-           KeyFile,
-           " -out ",
-           KeyFileTmp],
-    cmd(Cmd, []),
-    ok = file:rename(KeyFileTmp, KeyFile).
+    cmd(Cmd2, Env);
+create_self_signed_cert(Root, CAName, Cnf, C) ->
+    CARoot = filename:join([Root, CAName]),
+    CnfFile = filename:join([CARoot, "req.cnf"]),
+    file:write_file(CnfFile, Cnf),
+    KeyFile = filename:join([CARoot, "private", "key.pem"]), 
+    CertFile = filename:join([CARoot, "cert.pem"]), 
+    Cmd = [C#config.openssl_cmd, " req"
+	   " -new"
+	   " -x509"
+	   " -config ", CnfFile,
+	   " -keyout ", KeyFile,
+	   " -outform PEM",
+	   " -out ", CertFile], 
+    Env = [{"ROOTDIR", filename:absname(Root)}],  
+    cmd(Cmd, Env).
+
 
 create_ca_dir(Root, CAName, Cnf) ->
     CARoot = filename:join([Root, CAName]),
+    ok = filelib:ensure_dir(CARoot),
     file:make_dir(CARoot),
     create_dirs(CARoot, ["certs", "crl", "newcerts", "private"]),
     create_rnd(Root, filename:join([CAName, "private"])),
     create_files(CARoot, [{"serial", "01\n"},
+			  {"crlnumber", "01"},
 			  {"index.txt", ""},
 			  {"ca.cnf", Cnf}]).
 
-create_req(Root, OpenSSLCmd, CnfFile, KeyFile, ReqFile) ->
-    Cmd = [OpenSSLCmd, " req"
+create_req(Root, CnfFile, KeyFile, ReqFile, C = #config{ecc_certs = true}) ->
+    Cmd = [C#config.openssl_cmd, " ecparam"
+	   " -out ", KeyFile,
+	   " -name secp521r1 ",
+	   %" -name sect283k1 ",
+	   " -genkey "],
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
+    cmd(Cmd, Env),
+    Cmd2 = [C#config.openssl_cmd, " req"
+	   " -new ",
+	   " -key ", KeyFile,
+	   " -outform PEM ",
+	   " -out ", ReqFile,
+	   " -config ", CnfFile],
+    cmd(Cmd2, Env);
+    %fix_key_file(KeyFile).
+create_req(Root, CnfFile, KeyFile, ReqFile, C) ->
+    Cmd = [C#config.openssl_cmd, " req"
 	   " -new"
 	   " -config ", CnfFile,
+	   " -outform PEM ",
 	   " -keyout ", KeyFile, 
 	   " -out ", ReqFile], 
-    Env = [{"ROOTDIR", Root}], 
-    cmd(Cmd, Env),
-    fix_key_file(OpenSSLCmd, KeyFile).
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
+    cmd(Cmd, Env).
+    %fix_key_file(KeyFile).
+
 
-sign_req(Root, OpenSSLCmd, CA, CertType, ReqFile, CertFile) ->
+sign_req(Root, CA, CertType, ReqFile, CertFile, C) ->
     CACnfFile = filename:join([Root, CA, "ca.cnf"]),
-    Cmd = [OpenSSLCmd, " ca"
+    Cmd = [C#config.openssl_cmd, " ca"
 	   " -batch"
 	   " -notext"
 	   " -config ", CACnfFile, 
 	   " -extensions ", CertType,
 	   " -in ", ReqFile, 
 	   " -out ", CertFile],
-    Env = [{"ROOTDIR", Root}], 
+    Env = [{"ROOTDIR", filename:absname(Root)}], 
     cmd(Cmd, Env).
     
 %%
@@ -194,19 +311,19 @@ cmd(Cmd, Env) ->
     FCmd = lists:flatten(Cmd),
     Port = open_port({spawn, FCmd}, [stream, eof, exit_status, stderr_to_stdout, 
 				    {env, Env}]),
-    eval_cmd(Port).
+    eval_cmd(Port, FCmd).
 
-eval_cmd(Port) ->
+eval_cmd(Port, Cmd) ->
     receive 
 	{Port, {data, _}} ->
-	    eval_cmd(Port);
+	    eval_cmd(Port, Cmd);
 	{Port, eof} ->
 	    ok
     end,
     receive
 	{Port, {exit_status, Status}} when Status /= 0 ->
 	    %% io:fwrite("exit status: ~w~n", [Status]),
-	    exit({eval_cmd, Status})
+	    exit({eval_cmd, Cmd, Status})
     after 0 ->
 	    ok
     end.
@@ -215,7 +332,7 @@ eval_cmd(Port) ->
 %% Contents of configuration files 
 %%
 
-req_cnf(DN) ->
+req_cnf(C) ->
     ["# Purpose: Configuration for requests (end users and CAs)."
      "\n"
      "ROOTDIR	        = $ENV::ROOTDIR\n"
@@ -224,7 +341,7 @@ req_cnf(DN) ->
      "[req]\n"
      "input_password	= secret\n"
      "output_password	= secret\n"
-     "default_bits	= 1024\n"
+     "default_bits	= ", integer_to_list(C#config.default_bits), "\n"
      "RANDFILE		= $ROOTDIR/RAND\n"
      "encrypt_key	= no\n"
      "default_md	= sha1\n"
@@ -235,12 +352,12 @@ req_cnf(DN) ->
      "\n"
 
      "[name]\n"
-     "commonName		= ", DN#dn.commonName, "\n"
-     "organizationalUnitName	= ", DN#dn.organizationalUnitName, "\n"
-     "organizationName	        = ", DN#dn.organizationName, "\n" 
-     "localityName		= ", DN#dn.localityName, "\n"
-     "countryName		= ", DN#dn.countryName, "\n"
-     "emailAddress		= ", DN#dn.emailAddress, "\n"
+     "commonName		= ", C#config.commonName, "\n"
+     "organizationalUnitName	= ", C#config.organizationalUnitName, "\n"
+     "organizationName	        = ", C#config.organizationName, "\n" 
+     "localityName		= ", C#config.localityName, "\n"
+     "countryName		= ", C#config.countryName, "\n"
+     "emailAddress		= ", C#config.emailAddress, "\n"
      "\n"
 
      "[ca_ext]\n"
@@ -249,8 +366,7 @@ req_cnf(DN) ->
      "subjectKeyIdentifier = hash\n"
      "subjectAltName	= email:copy\n"].
 
-
-ca_cnf(CA) ->
+ca_cnf(C) ->
     ["# Purpose: Configuration for CAs.\n"
      "\n"
      "ROOTDIR	        = $ENV::ROOTDIR\n"
@@ -258,21 +374,23 @@ ca_cnf(CA) ->
      "\n"
 
      "[ca]\n"
-     "dir		= $ROOTDIR/", CA, "\n"
+     "dir		= $ROOTDIR/", C#config.commonName, "\n"
      "certs		= $dir/certs\n"
      "crl_dir	        = $dir/crl\n"
      "database	        = $dir/index.txt\n"
      "new_certs_dir	= $dir/newcerts\n"
      "certificate	= $dir/cert.pem\n"
      "serial		= $dir/serial\n"
-     "crl		= $dir/crl.pem\n"
+     "crl		= $dir/crl.pem\n",
+     ["crlnumber		= $dir/crlnumber\n" || C#config.v2_crls],
      "private_key	= $dir/private/key.pem\n"
      "RANDFILE	        = $dir/private/RAND\n"
      "\n"
-     "x509_extensions   = user_cert\n"
+     "x509_extensions   = user_cert\n",
+     ["crl_extensions = crl_ext\n" || C#config.v2_crls],
      "unique_subject  = no\n"
      "default_days	= 3600\n"
-     "default_md	= sha1\n"
+     "default_md	= sha256\n"
      "preserve	        = no\n"
      "policy		= policy_match\n"
      "\n"
@@ -286,6 +404,13 @@ ca_cnf(CA) ->
      "emailAddress		= supplied\n"
      "\n"
 
+     "[crl_ext]\n"
+     "authorityKeyIdentifier=keyid:always,issuer:always\n",
+     ["issuingDistributionPoint=critical, @idpsec\n" || C#config.issuing_distribution_point],
+
+     "[idpsec]\n"
+     "fullname=URI:http://localhost:8000/",C#config.commonName,"/crl.pem\n"
+
      "[user_cert]\n"
      "basicConstraints	= CA:false\n"
      "keyUsage 		= nonRepudiation, digitalSignature, keyEncipherment\n"
@@ -293,6 +418,12 @@ ca_cnf(CA) ->
      "authorityKeyIdentifier = keyid,issuer:always\n"
      "subjectAltName	= email:copy\n"
      "issuerAltName	= issuer:copy\n"
+     "crlDistributionPoints=@crl_section\n"
+
+     "[crl_section]\n"
+     %% intentionally invalid
+     "URI.1=http://localhost/",C#config.commonName,"/crl.pem\n"
+     "URI.2=http://localhost:8000/",C#config.commonName,"/crl.pem\n"
      "\n"
 
      "[user_cert_digital_signature_only]\n"
@@ -310,4 +441,7 @@ ca_cnf(CA) ->
      "subjectKeyIdentifier = hash\n"
      "authorityKeyIdentifier = keyid:always,issuer:always\n"
      "subjectAltName	= email:copy\n"
-     "issuerAltName	= issuer:copy\n"].
+     "issuerAltName	= issuer:copy\n"
+     "crlDistributionPoints=@crl_section\n"
+    ].
+
diff --git a/lib/ssl/test/ssl_crl_SUITE.erl b/lib/ssl/test/ssl_crl_SUITE.erl
new file mode 100644
index 0000000000..da0349904c
--- /dev/null
+++ b/lib/ssl/test/ssl_crl_SUITE.erl
@@ -0,0 +1,530 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2013. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+
+-module(ssl_crl_SUITE).
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+
+-include_lib("common_test/include/ct.hrl").
+-include_lib("public_key/include/public_key.hrl").
+
+-define(TIMEOUT, 120000).
+-define(LONG_TIMEOUT, 600000).
+-define(SLEEP, 1000).
+-define(OPENSSL_RENEGOTIATE, "R\n").
+-define(OPENSSL_QUIT, "Q\n").
+-define(OPENSSL_GARBAGE, "P\n").
+-define(EXPIRE, 10).
+
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+
+suite() -> [{ct_hooks,[ts_install_cth]}].
+
+all() -> 
+    [
+     {group, basic},
+     {group, v1_crl},
+     {group, idp_crl}
+    ].
+
+groups() ->
+    [{basic, [], basic_tests()},
+     {v1_crl, [], v1_crl_tests()},
+     {idp_crl, [], idp_crl_tests()}].
+
+basic_tests() ->
+    [crl_verify_valid, crl_verify_revoked].
+
+v1_crl_tests() ->
+    [crl_verify_valid, crl_verify_revoked].
+
+idp_crl_tests() ->
+    [crl_verify_valid, crl_verify_revoked].
+
+%%%================================================================
+%%% Suite init/end
+
+init_per_suite(Config0) ->
+    Dog = ct:timetrap(?LONG_TIMEOUT *2),
+    case os:find_executable("openssl") of
+	false ->
+	    {skip, "Openssl not found"};
+	_ ->
+	    TLSVersion = ?config(tls_version, Config0),
+	    OpenSSL_version = (catch os:cmd("openssl version")),
+	    ct:log("TLS version: ~p~nOpenSSL version: ~p~n~n~p:module_info(): ~p~n~nssh:module_info(): ~p~n",
+		   [TLSVersion, OpenSSL_version, ?MODULE, ?MODULE:module_info(), ssh:module_info()]),
+	    case ssl_test_lib:enough_openssl_crl_support(OpenSSL_version) of
+		false ->
+		    {skip, io_lib:format("Bad openssl version: ~p",[OpenSSL_version])};
+		_ ->
+		    catch crypto:stop(),
+		    try crypto:start() of
+			ok ->
+			    ssl:start(),
+			    [{watchdog, Dog}, {openssl_version,OpenSSL_version} | Config0]
+		    catch _C:_E ->
+			    ct:log("crypto:start() caught ~p:~p",[_C,_E]),
+			    {skip, "Crypto did not start"}
+		    end
+	    end
+    end.
+
+end_per_suite(_Config) ->
+    ssl:stop(),
+    application:stop(crypto).
+
+%%%================================================================
+%%% Group init/end
+
+init_per_group(Group, Config) ->
+    ct:log("~p:~p~nlisteners to port 8000:~n~p~n)",[?MODULE,?LINE,os:cmd("netstat -tln|grep ':8000'")]),
+    ssl:start(),
+    inets:start(),
+    CertDir = filename:join(?config(priv_dir, Config), Group),
+    DataDir = ?config(data_dir, Config),
+    ServerRoot = make_dir_path([?config(priv_dir,Config), Group, tmp]),
+    Result =  make_certs:all(DataDir, CertDir, cert_opts(Group)),
+    ct:log("~p:~p~nmake_certs:all(~n DataDir=~p,~n CertDir=~p,~n ServerRoot=~p~n Opts=~p~n) returned ~p~n", [?MODULE,?LINE,DataDir, CertDir, ServerRoot, cert_opts(Group), Result]),
+    %% start a HTTP server to serve the CRLs
+    {ok, Httpd} = inets:start(httpd, [{server_name, "localhost"}, {port, 8000},
+				      {server_root, ServerRoot},
+				      {document_root, CertDir},
+				      {modules, [mod_get]}
+				     ]),
+    ct:log("~p:~p~nlisteners to port 8000:~n~p~n)",[?MODULE,?LINE,os:cmd("netstat -tln|grep ':8000'")]),
+    [{make_cert_result, Result}, {cert_dir, CertDir}, {httpd, Httpd} | Config].
+
+cert_opts(v1_crl)  -> [{v2_crls, false}];
+cert_opts(idp_crl) -> [{issuing_distribution_point, true}];
+cert_opts(_) -> [].
+
+make_dir_path(PathComponents) ->
+    lists:foldl(fun(F,P0) -> file:make_dir(P=filename:join(P0,F)), P end,
+		"",
+		PathComponents).
+
+
+end_per_group(_GroupName, Config) ->
+    case ?config(httpd, Config) of
+	undefined -> ok;
+	Pid -> 
+	    ct:log("Stop httpd ~p",[Pid]),
+	   ok = inets:stop(httpd, Pid)
+		,ct:log("Stopped",[])
+    end,
+    inets:stop(),
+    ct:log("~p:~p~nlisteners to port 8000:~n~p~n)",[?MODULE,?LINE,os:cmd("netstat -tln|grep ':8000'")]),
+    Config.
+
+%%%================================================================
+%%% Test cases
+
+crl_verify_valid() ->
+    [{doc,"Verify a simple valid CRL chain"}].
+crl_verify_valid(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    PrivDir = ?config(cert_dir, Config),
+    ServerOpts = [{keyfile, filename:join([PrivDir, "server", "key.pem"])},
+		  {certfile, filename:join([PrivDir, "server", "cert.pem"])},
+		  {cacertfile, filename:join([PrivDir, "server", "cacerts.pem"])}],
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Data = "From openssl to erlang",
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+			   %{mfa, {ssl_test_lib, no_result, []}},
+			   {options, ServerOpts}]),
+    ct:log("~p:~p~nreturn from ssl_test_lib:start_server:~n~p",[?MODULE,?LINE,Server]),
+    Port = ssl_test_lib:inet_port(Server),
+
+    CACerts = load_cert(filename:join([PrivDir, "erlangCA", "cacerts.pem"])),
+
+    ClientOpts = [{cacerts, CACerts},
+		  {verify, verify_peer},
+		  {verify_fun, {fun validate_function/3, {CACerts, []}}}],
+
+
+    ct:log("~p:~p~ncalling ssl_test_lib:start_client",[?MODULE,?LINE]),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {?MODULE, 
+					       erlang_ssl_send, [Data]}},
+					%{mfa, {ssl_test_lib, no_result, []}},
+					{options, ClientOpts}]),
+    ct:log("~p:~p~nreturn from ssl_test_lib:start_client:~n~p",[?MODULE,?LINE,Client]),
+
+    ssl_test_lib:check_result(Client, ok,  Server, ok),
+
+    %% Clean close down!   Server needs to be closed first !!
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client),
+    process_flag(trap_exit, false).
+
+crl_verify_revoked() ->
+    [{doc,"Verify a simple valid CRL chain"}].
+crl_verify_revoked(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    PrivDir = ?config(cert_dir, Config),
+    ServerOpts = [{keyfile, filename:join([PrivDir, "revoked", "key.pem"])},
+		  {certfile, filename:join([PrivDir, "revoked", "cert.pem"])},
+		  {cacertfile, filename:join([PrivDir, "revoked", "cacerts.pem"])}],
+    ct:log("~p:~p~nserver opts ~p~n", [?MODULE,?LINE, ServerOpts]),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+			   %{mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+			   {mfa, {ssl_test_lib, no_result, []}},
+			   {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+
+    CACerts = load_cert(filename:join([PrivDir, "erlangCA", "cacerts.pem"])),
+    ClientOpts = [{cacerts, CACerts},
+		  {verify, verify_peer},
+		  {verify_fun, {fun validate_function/3, {CACerts, []}}}],
+
+    {connect_failed, _} = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					%{mfa, {?MODULE, 
+					       %erlang_ssl_receive, [Data]}},
+					{mfa, {ssl_test_lib, no_result, []}},
+					{options, ClientOpts}]),
+
+    %% Clean close down!   Server needs to be closed first !!
+    ssl_test_lib:close(Server),
+    process_flag(trap_exit, false).
+
+%%%================================================================
+%%% Lib
+
+erlang_ssl_receive(Socket, Data) ->
+    ct:log("~p:~p~nConnection info: ~p~n",
+		       [?MODULE,?LINE, ssl:connection_info(Socket)]),
+    receive
+	{ssl, Socket, Data} ->
+	    ct:log("~p:~p~nReceived ~p~n",[?MODULE,?LINE, Data]),
+	    %% open_ssl server sometimes hangs waiting in blocking read
+	    ssl:send(Socket, "Got it"), 
+	    ok;
+	{ssl, Socket, Byte} when length(Byte) == 1 ->
+	    erlang_ssl_receive(Socket, tl(Data));
+	{Port, {data,Debug}} when is_port(Port) ->
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
+	    erlang_ssl_receive(Socket,Data);
+	Other ->
+	    ct:fail({unexpected_message, Other})
+    after 4000 ->
+	    ct:fail({did_not_get, Data})
+    end.
+
+
+erlang_ssl_send(Socket, Data) ->
+    ct:log("~p:~p~nConnection info: ~p~n",
+		       [?MODULE,?LINE, ssl:connection_info(Socket)]),
+    ssl:send(Socket, Data),
+    ok.
+
+load_certs(undefined) ->
+    undefined;
+load_certs(CertDir) ->
+    case file:list_dir(CertDir) of
+        {ok, Certs} ->
+            load_certs(lists:map(fun(Cert) -> filename:join(CertDir, Cert)
+                    end, Certs), []);
+        {error, _} ->
+            undefined
+    end.
+
+load_certs([], Acc) ->
+    ct:log("~p:~p~nSuccessfully loaded ~p CA certificates~n", [?MODULE,?LINE, length(Acc)]),
+    Acc;
+load_certs([Cert|Certs], Acc) ->
+    case filelib:is_dir(Cert) of
+        true ->
+            load_certs(Certs, Acc);
+        _ ->
+            %ct:log("~p:~p~nLoading certificate ~p~n", [?MODULE,?LINE, Cert]),
+            load_certs(Certs, load_cert(Cert) ++ Acc)
+    end.
+
+load_cert(Cert) ->
+    {ok, Bin} = file:read_file(Cert),
+    case filename:extension(Cert) of
+        ".der" ->
+            %% no decoding necessary
+            [Bin];
+        _ ->
+            %% assume PEM otherwise
+            Contents = public_key:pem_decode(Bin),
+            [DER || {Type, DER, Cipher} <- Contents, Type == 'Certificate', Cipher == 'not_encrypted']
+    end.
+
+%% @doc Validator function for SSL negotiation.
+%%
+validate_function(Cert, valid_peer, State) ->
+    ct:log("~p:~p~nvaliding peer ~p with ~p intermediate certs~n",
+                [?MODULE,?LINE, get_common_name(Cert), 
+                 length(element(2, State))]),
+    %% peer certificate validated, now check the CRL
+    Res = (catch check_crl(Cert, State)),
+    ct:log("~p:~p~nCRL validate result for ~p: ~p~n",
+                [?MODULE,?LINE, get_common_name(Cert), Res]),
+    {Res, State};
+validate_function(Cert, valid, {TrustedCAs, IntermediateCerts}=State) ->
+    case public_key:pkix_is_self_signed(Cert) of
+        true ->
+            ct:log("~p:~p~nroot certificate~n",[?MODULE,?LINE]),
+            %% this is a root cert, no CRL
+            {valid, {TrustedCAs, [Cert|IntermediateCerts]}};
+        false ->
+            %% check is valid CA certificate, add to the list of
+            %% intermediates
+            Res = (catch check_crl(Cert, State)),
+            ct:log("~p:~p~nCRL intermediate CA validate result for ~p: ~p~n",
+                        [?MODULE,?LINE, get_common_name(Cert), Res]),
+            {Res, {TrustedCAs, [Cert|IntermediateCerts]}}
+    end;
+validate_function(_Cert, _Event, State) ->
+    %ct:log("~p:~p~nignoring event ~p~n", [?MODULE,?LINE, _Event]),
+    {valid, State}.
+
+%% @doc Given a certificate, find CRL distribution points for the given
+%%      certificate, fetch, and attempt to validate each CRL through
+%%      issuer_function/4.
+%%
+check_crl(Cert, State) ->
+    %% pull the CRL distribution point(s) out of the certificate, if any
+    ct:log("~p:~p~ncheck_crl(~n Cert=~p,~nState=~p~n)",[?MODULE,?LINE,Cert,State]),
+    case pubkey_cert:select_extension(
+	   ?'id-ce-cRLDistributionPoints',
+	   pubkey_cert:extensions_list(Cert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.extensions)) of
+        undefined ->
+            ct:log("~p:~p~nno CRL distribution points for ~p~n",
+                         [?MODULE,?LINE, get_common_name(Cert)]),
+            %% fail; we can't validate if there's no CRL
+            no_crl;
+        CRLExtension ->
+	    ct:log("~p:~p~nCRLExtension=~p)",[?MODULE,?LINE,CRLExtension]),
+            CRLDistPoints = CRLExtension#'Extension'.extnValue,
+            DPointsAndCRLs = lists:foldl(fun(Point, Acc) -> 
+                            %% try to read the CRL over http or from a
+                            %% local file
+                            case fetch_point(Point) of
+                                not_available ->
+				    ct:log("~p:~p~nfetch_point returned~n~p~n)",[?MODULE,?LINE,not_available]),
+                                    Acc;
+                                Res ->
+				    ct:log("~p:~p~nfetch_point returned~n~p~n)",[?MODULE,?LINE,Res]),
+                                    [{Point, Res} | Acc]
+                            end 
+                    end, [], CRLDistPoints),
+            public_key:pkix_crls_validate(Cert, 
+                                          DPointsAndCRLs, 
+                                          [{issuer_fun, 
+                                            {fun issuer_function/4, State}}])
+    end.
+
+%% @doc Given a list of distribution points for CRLs, certificates and
+%%      both trusted and intermediary certificates, attempt to build and
+%%      authority chain back via build_chain to verify that it is valid.
+%%
+issuer_function(_DP, CRL, _Issuer, {TrustedCAs, IntermediateCerts}) ->
+    %% XXX the 'Issuer' we get passed here is the AuthorityKeyIdentifier,
+    %% which we are not currently smart enough to understand
+    %% Read the CA certs out of the file
+    ct:log("~p:~p~nissuer_function(~nCRL=~p,~nLast param=~p)",[?MODULE,?LINE,CRL, {TrustedCAs, IntermediateCerts}]),
+    Certs = [public_key:pkix_decode_cert(DER, otp) || DER <- TrustedCAs],
+    %% get the real issuer out of the CRL
+    Issuer = public_key:pkix_normalize_name(
+            pubkey_cert_records:transform(
+                CRL#'CertificateList'.tbsCertList#'TBSCertList'.issuer, decode)),
+    %% assume certificates are ordered from root to tip
+    case find_issuer(Issuer, IntermediateCerts ++ Certs) of
+        undefined ->
+            ct:log("~p:~p~nunable to find certificate matching CRL issuer ~p~n", 
+                        [?MODULE,?LINE, Issuer]),
+            error;
+        IssuerCert ->
+	    ct:log("~p:~p~nIssuerCert=~p~n)",[?MODULE,?LINE,IssuerCert]),
+            case build_chain({public_key:pkix_encode('OTPCertificate', 
+                                                     IssuerCert, 
+                                                     otp), 
+                              IssuerCert}, IntermediateCerts, Certs, []) of
+                undefined ->
+                    error;
+                {OTPCert, Path} ->
+                    {ok, OTPCert, Path}
+            end
+    end.
+
+%% @doc Attempt to build authority chain back using intermediary
+%%      certificates, falling back on trusted certificates if the
+%%      intermediary chain of certificates does not fully extend to the 
+%%      root.
+%% 
+%%      Returns: {RootCA :: #OTPCertificate{}, Chain :: [der_encoded()]}
+%%
+build_chain({DER, Cert}, IntCerts, TrustedCerts, Acc) ->
+    %% check if this cert is self-signed, if it is, we've reached the
+    %% root of the chain
+    Issuer = public_key:pkix_normalize_name(
+            Cert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.issuer),
+    Subject = public_key:pkix_normalize_name(
+            Cert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subject),
+    case Issuer == Subject of
+        true ->
+            case find_issuer(Issuer, TrustedCerts) of
+                undefined ->
+                    ct:log("~p:~p~nself-signed certificate is NOT trusted~n",[?MODULE,?LINE]),
+                    undefined;
+                TrustedCert ->
+                    %% return the cert from the trusted list, to prevent
+                    %% issuer spoofing
+                    {TrustedCert, 
+                     [public_key:pkix_encode(
+                                'OTPCertificate', TrustedCert, otp)|Acc]}
+            end;
+        false ->
+            Match = lists:foldl(
+                      fun(C, undefined) ->
+                              S = public_key:pkix_normalize_name(C#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subject),
+                              %% compare the subject to the current issuer
+                              case Issuer == S of
+                                  true ->
+                                      %% we've found our man
+                                      {public_key:pkix_encode('OTPCertificate', C, otp), C};
+                                  false ->
+                                      undefined
+                              end;
+                         (_E, A) ->
+                              %% already matched
+                              A
+                      end, undefined, IntCerts),
+            case Match of
+                undefined when IntCerts /= TrustedCerts ->
+                    %% continue the chain by using the trusted CAs
+                    ct:log("~p:~p~nRan out of intermediate certs, switching to trusted certs~n",[?MODULE,?LINE]),
+                    build_chain({DER, Cert}, TrustedCerts, TrustedCerts, Acc);
+                undefined ->
+                    ct:log("Can't construct chain of trust beyond ~p~n",
+                                [?MODULE,?LINE, get_common_name(Cert)]),
+                    %% can't find the current cert's issuer
+                    undefined;
+                Match ->
+                    build_chain(Match, IntCerts, TrustedCerts, [DER|Acc])
+            end
+    end.
+
+%% @doc Given a certificate and a list of trusted or intermediary
+%%      certificates, attempt to find a match in the list or bail with
+%%      undefined.
+find_issuer(Issuer, Certs) ->
+    lists:foldl(
+      fun(OTPCert, undefined) ->
+              %% check if this certificate matches the issuer
+              Normal = public_key:pkix_normalize_name(
+                        OTPCert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subject),
+              case Normal == Issuer of
+                  true ->
+                      OTPCert;
+                  false ->
+                      undefined
+              end;
+         (_E, Acc) ->
+              %% already found a match
+              Acc
+      end, undefined, Certs).
+
+%% @doc Find distribution points for a given CRL and then attempt to
+%%      fetch the CRL from the first available.
+fetch_point(#'DistributionPoint'{distributionPoint={fullName, Names}}) ->
+    Decoded = [{NameType, 
+                pubkey_cert_records:transform(Name, decode)} 
+               || {NameType, Name} <- Names],
+    ct:log("~p:~p~ncall fetch(~nDecoded=~p~n)",[?MODULE,?LINE,Decoded]),
+    fetch(Decoded).
+
+%% @doc Given a list of locations to retrieve a CRL from, attempt to
+%%      retrieve either from a file or http resource and bail as soon as
+%%      it can be found.
+%%
+%%      Currently, only hand a armored PEM or DER encoded file, with
+%%      defaulting to DER.
+%%
+fetch([]) ->
+    not_available;
+fetch([{uniformResourceIdentifier, "http"++_=URL}|Rest]) ->
+    ct:log("~p:~p~ngetting CRL from ~p~n", [?MODULE,?LINE, URL]),
+    ct:log("~p:~p~nlisteners to port 8000:~n~p~n)",[?MODULE,?LINE,os:cmd("netstat -tln|grep ':8000'")]),
+    case httpc:request(get, {URL, []}, [], [{body_format, binary}]) of
+        {ok, {_Status, _Headers, Body}} ->
+            case Body of
+                <<"-----BEGIN", _/binary>> ->
+		    ct:log("~p:~p~npublic_key:pem_decode,~nBody=~p~n)",[?MODULE,?LINE,Body]),
+                    [{'CertificateList', 
+                      DER, _}=CertList] = public_key:pem_decode(Body),
+		    ct:log("~p:~p~npublic_key:pem_entry_decode,~nCertList=~p~n)",[?MODULE,?LINE,CertList]),
+                    {DER, public_key:pem_entry_decode(CertList)};
+                _ ->
+		    ct:log("~p:~p~npublic_key:pem_entry_decode,~nBody=~p~n)",[?MODULE,?LINE,{'CertificateList', Body, not_encrypted}]),
+                    %% assume DER encoded
+                    CertList = public_key:pem_entry_decode(
+                            {'CertificateList', Body, not_encrypted}),
+                    {Body, CertList}
+            end;
+        {error, _Reason} ->
+            ct:log("~p:~p~nfailed to get CRL ~p~n", [?MODULE,?LINE, _Reason]),
+            fetch(Rest);
+	Other ->
+            ct:log("~p:~p~nreally failed to get CRL ~p~n", [?MODULE,?LINE, Other]),
+            fetch(Rest)
+    end;
+fetch([Loc|Rest]) ->
+    %% unsupported CRL location
+    ct:log("~p:~p~nunable to fetch CRL from unsupported location ~p~n", 
+                [?MODULE,?LINE, Loc]),
+    fetch(Rest).
+
+%% get the common name attribute out of an OTPCertificate record
+get_common_name(OTPCert) ->
+    %% You'd think there'd be an easier way than this giant mess, but I
+    %% couldn't find one.
+    {rdnSequence, Subject} = OTPCert#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subject,
+    case [Attribute#'AttributeTypeAndValue'.value || [Attribute] <- Subject,
+        Attribute#'AttributeTypeAndValue'.type == ?'id-at-commonName'] of
+        [Att] ->
+            case Att of
+                {teletexString, Str} -> Str;
+                {printableString, Str} -> Str;
+                {utf8String, Bin} -> binary_to_list(Bin)
+            end;
+        _ ->
+            unknown
+    end.
+
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 7ed9adfcd9..7d8ece8d19 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -60,7 +60,7 @@ run_server(Opts) ->
     Options = proplists:get_value(options, Opts),
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
-    ct:log("ssl:listen(~p, ~p)~n", [Port, Options]),
+    ct:log("~p:~p~nssl:listen(~p, ~p)~n", [?MODULE,?LINE, Port, Options]),
     {ok, ListenSocket} = rpc:call(Node, Transport, listen, [Port, Options]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
@@ -78,13 +78,13 @@ do_run_server(ListenSocket, AcceptSocket, Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport = proplists:get_value(transport, Opts, ssl),
     {Module, Function, Args} = proplists:get_value(mfa, Opts),
-    ct:log("Server: apply(~p,~p,~p)~n",
-		       [Module, Function, [AcceptSocket | Args]]),
+    ct:log("~p:~p~nServer: apply(~p,~p,~p)~n",
+		       [?MODULE,?LINE, Module, Function, [AcceptSocket | Args]]),
     case rpc:call(Node, Module, Function, [AcceptSocket | Args]) of
 	no_result_msg ->
 	    ok;
 	Msg ->
-	    ct:log("Server Msg: ~p ~n", [Msg]),
+	    ct:log("~p:~p~nServer Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 	    Pid ! {self(), Msg}
     end,
     receive
@@ -93,10 +93,10 @@ do_run_server(ListenSocket, AcceptSocket, Opts) ->
 	{listen, MFA} ->
 	    run_server(ListenSocket, [MFA | proplists:delete(mfa, Opts)]);
 	close ->
-	    ct:log("Server closing  ~p ~n", [self()]),
+	    ct:log("~p:~p~nServer closing  ~p ~n", [?MODULE,?LINE, self()]),
 	    Result = rpc:call(Node, Transport, close, [AcceptSocket], 500),
 	    Result1 = rpc:call(Node, Transport, close, [ListenSocket], 500),
-	    ct:log("Result ~p : ~p ~n", [Result, Result1]);
+	    ct:log("~p:~p~nResult ~p : ~p ~n", [?MODULE,?LINE, Result, Result1]);
 	{ssl_closed, _} ->
 	    ok
     end.
@@ -116,7 +116,7 @@ connect(#sslsocket{} = ListenSocket, Opts) ->
     end;
 connect(ListenSocket, Opts) ->
     Node = proplists:get_value(node, Opts),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, 
 				  [ListenSocket]),
     AcceptSocket.
@@ -124,15 +124,17 @@ connect(ListenSocket, Opts) ->
 connect(_, _, 0, AcceptSocket, _) ->
     AcceptSocket;
 connect(ListenSocket, Node, N, _, Timeout) ->
-    ct:log("ssl:transport_accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~nssl:transport_accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, ssl, transport_accept, 
 				  [ListenSocket]),    
-    ct:log("ssl:ssl_accept(~p, ~p)~n", [AcceptSocket, Timeout]),
+    ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n", [?MODULE,?LINE, AcceptSocket, Timeout]),
 
     case rpc:call(Node, ssl, ssl_accept, [AcceptSocket, Timeout]) of
 	ok ->
+ct:log("~p:~p~nok from ssl:ssl_accept@~p",[?MODULE,?LINE, Node]),
 	    connect(ListenSocket, Node, N-1, AcceptSocket, Timeout);
 	Result ->
+ct:log("~p:~p~nssl:ssl_accept@~p ret ~p",[?MODULE,?LINE, Node,Result]),
 	    Result
     end.
 
@@ -148,11 +150,13 @@ remove_close_msg(ReconnectTimes) ->
 start_client(Args) ->
     Result = spawn_link(?MODULE, run_client_init, [lists:delete(return_socket, Args)]),
     receive 
-	{ connected, Socket } ->
-        case lists:member(return_socket, Args) of
-            true -> { Result, Socket };
-            false -> Result
-        end
+	{connected, Socket} ->
+	    case lists:member(return_socket, Args) of
+		true -> {Result, Socket};
+		false -> Result
+	    end;
+	{connect_failed, Reason} ->
+	    {connect_failed, Reason}
     end.
 
 run_client_init(Opts) ->
@@ -166,27 +170,30 @@ run_client(Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
     Options = proplists:get_value(options, Opts),
-    ct:log("ssl:connect(~p, ~p, ~p)~n", [Host, Port, Options]),
+    ct:log("~p:~p~nssl:connect(~p, ~p, ~p)~n", [?MODULE,?LINE, Host, Port, Options]),
+ct:log("~p:~p~nnet_adm:ping(~p)=~p",[?MODULE,?LINE, Node,net_adm:ping(Node)]),
+%%ct:log("~p:~p~n~p:connect(~p, ~p, ~p)@~p~n", [?MODULE,?LINE, Transport, Host, Port, Options, Node]),
+ct:log("~p:~p~n~p:connect(~p, ~p, ...)@~p~n", [?MODULE,?LINE, Transport, Host, Port, Node]),
     case rpc:call(Node, Transport, connect, [Host, Port, Options]) of
 	{ok, Socket} ->
-	    Pid ! { connected, Socket },
-	    ct:log("Client: connected~n", []),
+	    Pid ! {connected, Socket},
+	    ct:log("~p:~p~nClient: connected~n", [?MODULE,?LINE]),
 	    %% In special cases we want to know the client port, it will
 	    %% be indicated by sending {port, 0} in options list!
 	    send_selected_port(Pid,  proplists:get_value(port, Options), Socket),
 	    {Module, Function, Args} = proplists:get_value(mfa, Opts),
-	    ct:log("Client: apply(~p,~p,~p)~n",
-			       [Module, Function, [Socket | Args]]),
+	    ct:log("~p:~p~nClient: apply(~p,~p,~p)~n",
+			       [?MODULE,?LINE, Module, Function, [Socket | Args]]),
 	    case rpc:call(Node, Module, Function, [Socket | Args]) of
 		no_result_msg ->
 		    ok;
 		Msg ->
-		    ct:log("Client Msg: ~p ~n", [Msg]),
+		    ct:log("~p:~p~nClient Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 		    Pid ! {self(), Msg}
 	    end,
 	    receive
 		close ->
-		    ct:log("Client closing~n", []),
+		    ct:log("~p:~p~nClient closing~n", [?MODULE,?LINE]),
 		    rpc:call(Node, Transport, close, [Socket]);
 		{ssl_closed, Socket} ->
 		    ok;
@@ -196,50 +203,42 @@ run_client(Opts) ->
 	{error, econnrefused = Reason} ->
 	    case get(retries) of
 		N when N < 5 ->
+		    ct:log("~p:~p~neconnrefused retries=~p sleep ~p",[?MODULE,?LINE, N,?SLEEP]),
 		    put(retries, N+1),
 		    ct:sleep(?SLEEP),
 		    run_client(Opts);
 	       _ ->
-		    ct:log("Client faild several times: connection failed: ~p ~n", [Reason]),
+		    ct:log("~p:~p~nClient faild several times: connection failed: ~p ~n", [?MODULE,?LINE, Reason]),
 		    Pid ! {self(), {error, Reason}}
 	    end;
 	{error, Reason} ->
-	    ct:log("Client: connection failed: ~p ~n", [Reason]),
-	    Pid ! {self(), {error, Reason}}
+	    ct:log("~p:~p~nClient: connection failed: ~p ~n", [?MODULE,?LINE, Reason]),
+	    Pid ! {connect_failed, Reason};
+	{badrpc,BadRPC} ->
+            ct:log("~p:~p~nBad rpc: ~p",[?MODULE,?LINE, BadRPC]),
+            Pid ! {connect_failed, {badrpc,BadRPC}}
     end.
 
 close(Pid) ->
-    ct:log("Close ~p ~n", [Pid]),
+    ct:log("~p:~p~nClose ~p ~n", [?MODULE,?LINE, Pid]),
     Monitor = erlang:monitor(process, Pid),
     Pid ! close,
     receive
 	{'DOWN', Monitor, process, Pid, Reason} ->
 	    erlang:demonitor(Monitor),
-	    ct:log("Pid: ~p down due to:~p ~n", [Pid, Reason])
+	    ct:log("~p:~p~nPid: ~p down due to:~p ~n", [?MODULE,?LINE, Pid, Reason])
     end.
 
 check_result(Server, ServerMsg, Client, ClientMsg) -> 
     receive 
-	{Server, ServerMsg} -> 
-	    receive 
-		{Client, ClientMsg} ->
-		    ok;
-		Unexpected ->
-		    Reason = {{expected, {Client, ClientMsg}}, 
-			      {got, Unexpected}},
-		    ct:fail(Reason)
-	    end;
-	{Client, ClientMsg} -> 
-	    receive 
-		{Server, ServerMsg} ->
-		    ok;
-		Unexpected ->
-		    Reason = {{expected, {Server, ClientMsg}}, 
-			      {got, Unexpected}},
-		    ct:fail(Reason)
-	    end;
+	{Server, ServerMsg} ->
+	    check_result(Client, ClientMsg);
+
+	{Client, ClientMsg} ->
+	    check_result(Server, ServerMsg);
+
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    check_result(Server, ServerMsg, Client, ClientMsg);
 
 	Unexpected ->
@@ -253,7 +252,7 @@ check_result(Pid, Msg) ->
 	{Pid, Msg} -> 
 	    ok;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    check_result(Pid,Msg);
 	Unexpected ->
 	    Reason = {{expected, {Pid, Msg}}, 
@@ -278,7 +277,7 @@ wait_for_result(Server, ServerMsg, Client, ClientMsg) ->
 		%%     Unexpected
 	    end;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    wait_for_result(Server, ServerMsg, Client, ClientMsg)
 	%% Unexpected ->
 	%%     Unexpected
@@ -290,7 +289,7 @@ wait_for_result(Pid, Msg) ->
 	{Pid, Msg} -> 
 	    ok;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    wait_for_result(Pid,Msg)
 	%% Unexpected ->
 	%%     Unexpected
@@ -515,33 +514,33 @@ run_upgrade_server(Opts) ->
     SslOptions = proplists:get_value(ssl_options, Opts),
     Pid = proplists:get_value(from, Opts),
 
-    ct:log("gen_tcp:listen(~p, ~p)~n", [Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:listen(~p, ~p)~n", [?MODULE,?LINE, Port, TcpOptions]),
     {ok, ListenSocket} = rpc:call(Node, gen_tcp, listen, [Port, TcpOptions]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, [ListenSocket]),
 
     try
 	{ok, SslAcceptSocket} = case TimeOut of
 				    infinity ->
-					ct:log("ssl:ssl_accept(~p, ~p)~n",
-							   [AcceptSocket, SslOptions]),
+					ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n",
+							   [?MODULE,?LINE, AcceptSocket, SslOptions]),
 					rpc:call(Node, ssl, ssl_accept,
 						 [AcceptSocket, SslOptions]);
 				    _ ->
-					ct:log("ssl:ssl_accept(~p, ~p, ~p)~n",
-							   [AcceptSocket, SslOptions, TimeOut]),
+					ct:log("~p:~p~nssl:ssl_accept(~p, ~p, ~p)~n",
+							   [?MODULE,?LINE, AcceptSocket, SslOptions, TimeOut]),
 					rpc:call(Node, ssl, ssl_accept,
 						 [AcceptSocket, SslOptions, TimeOut])
 				end,
 	{Module, Function, Args} = proplists:get_value(mfa, Opts),
 	Msg = rpc:call(Node, Module, Function, [SslAcceptSocket | Args]),
-	ct:log("Upgrade Server Msg: ~p ~n", [Msg]),
+	ct:log("~p:~p~nUpgrade Server Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 	Pid ! {self(), Msg},
 	receive
 	    close ->
-		ct:log("Upgrade Server closing~n", []),
+		ct:log("~p:~p~nUpgrade Server closing~n", [?MODULE,?LINE]),
 		rpc:call(Node, ssl, close, [SslAcceptSocket])
 	end
     catch error:{badmatch, Error} ->
@@ -559,24 +558,24 @@ run_upgrade_client(Opts) ->
     TcpOptions = proplists:get_value(tcp_options, Opts),
     SslOptions = proplists:get_value(ssl_options, Opts),
     
-    ct:log("gen_tcp:connect(~p, ~p, ~p)~n",
-		       [Host, Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:connect(~p, ~p, ~p)~n",
+		       [?MODULE,?LINE, Host, Port, TcpOptions]),
     {ok, Socket} = rpc:call(Node, gen_tcp, connect, [Host, Port, TcpOptions]),
 
     send_selected_port(Pid, Port, Socket),
 
-    ct:log("ssl:connect(~p, ~p)~n", [Socket, SslOptions]),
+    ct:log("~p:~p~nssl:connect(~p, ~p)~n", [?MODULE,?LINE, Socket, SslOptions]),
     {ok, SslSocket} = rpc:call(Node, ssl, connect, [Socket, SslOptions]),
 
     {Module, Function, Args} = proplists:get_value(mfa, Opts),
-    ct:log("apply(~p, ~p, ~p)~n",
-		       [Module, Function, [SslSocket | Args]]),
+    ct:log("~p:~p~napply(~p, ~p, ~p)~n",
+		       [?MODULE,?LINE, Module, Function, [SslSocket | Args]]),
     Msg = rpc:call(Node, Module, Function, [SslSocket | Args]),
-    ct:log("Upgrade Client Msg: ~p ~n", [Msg]),
+    ct:log("~p:~p~nUpgrade Client Msg: ~p ~n", [?MODULE,?LINE, Msg]),
     Pid ! {self(), Msg},
     receive 
 	close ->
-	    ct:log("Upgrade Client closing~n", []),
+	    ct:log("~p:~p~nUpgrade Client closing~n", [?MODULE,?LINE]),
 	    rpc:call(Node, ssl, close, [SslSocket])
     end.
 
@@ -595,21 +594,21 @@ run_upgrade_server_error(Opts) ->
     SslOptions = proplists:get_value(ssl_options, Opts),
     Pid = proplists:get_value(from, Opts),
 
-    ct:log("gen_tcp:listen(~p, ~p)~n", [Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:listen(~p, ~p)~n", [?MODULE,?LINE, Port, TcpOptions]),
     {ok, ListenSocket} = rpc:call(Node, gen_tcp, listen, [Port, TcpOptions]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, [ListenSocket]),
     Error = case TimeOut of
 		infinity ->
-		    ct:log("ssl:ssl_accept(~p, ~p)~n",
-				       [AcceptSocket, SslOptions]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n",
+				       [?MODULE,?LINE, AcceptSocket, SslOptions]),
 		    rpc:call(Node, ssl, ssl_accept,
 			     [AcceptSocket, SslOptions]);
 		_ ->
-		    ct:log("ssl:ssl_accept(~p, ~p, ~p)~n",
-				       [AcceptSocket, SslOptions, TimeOut]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p, ~p, ~p)~n",
+				       [?MODULE,?LINE, AcceptSocket, SslOptions, TimeOut]),
 		    rpc:call(Node, ssl, ssl_accept,
 			     [AcceptSocket, SslOptions, TimeOut])
 	    end,
@@ -628,26 +627,26 @@ run_server_error(Opts) ->
     Options = proplists:get_value(options, Opts),
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
-    ct:log("ssl:listen(~p, ~p)~n", [Port, Options]),
+    ct:log("~p:~p~nssl:listen(~p, ~p)~n", [?MODULE,?LINE, Port, Options]),
     case rpc:call(Node, Transport, listen, [Port, Options]) of
 	{ok, #sslsocket{} = ListenSocket} ->
 	    %% To make sure error_client will
 	    %% get {error, closed} and not {error, connection_refused}
 	    Pid ! {listen, up},
 	    send_selected_port(Pid, Port, ListenSocket),
-	    ct:log("ssl:transport_accept(~p)~n", [ListenSocket]),
+	    ct:log("~p:~p~nssl:transport_accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
 	    case rpc:call(Node, Transport, transport_accept, [ListenSocket]) of
 		{error, _} = Error ->
 		    Pid ! {self(), Error};
 		{ok, AcceptSocket} ->
-		    ct:log("ssl:ssl_accept(~p)~n", [AcceptSocket]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p)~n", [?MODULE,?LINE, AcceptSocket]),
 		    Error = rpc:call(Node, ssl, ssl_accept, [AcceptSocket]),
 		    Pid ! {self(), Error}
 	    end;
 	{ok, ListenSocket} ->
 	    Pid ! {listen, up},
 	    send_selected_port(Pid, Port, ListenSocket),
-	    ct:log("~p:accept(~p)~n", [Transport, ListenSocket]),
+	    ct:log("~p:~p~n~p:accept(~p)~n", [?MODULE,?LINE, Transport, ListenSocket]),
 	     case rpc:call(Node, Transport, accept, [ListenSocket]) of
 		{error, _} = Error ->
 		     Pid ! {self(), Error}
@@ -669,7 +668,7 @@ run_client_error(Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport = proplists:get_value(transport, Opts, ssl),
     Options = proplists:get_value(options, Opts),
-    ct:log("ssl:connect(~p, ~p, ~p)~n", [Host, Port, Options]),
+    ct:log("~p:~p~nssl:connect(~p, ~p, ~p)~n", [?MODULE,?LINE, Host, Port, Options]),
     Error = rpc:call(Node, Transport, connect, [Host, Port, Options]),
     Pid ! {self(), Error}.
 
@@ -892,7 +891,7 @@ der_to_pem(File, Entries) ->
 
 cipher_result(Socket, Result) ->
     Result = ssl:connection_info(Socket),
-    ct:log("Successfull connect: ~p~n", [Result]),
+    ct:log("~p:~p~nSuccessfull connect: ~p~n", [?MODULE,?LINE, Result]),
     %% Importante to send two packets here
     %% to properly test "cipher state" handling
     ssl:send(Socket, "Hello\n"),
@@ -1061,10 +1060,13 @@ check_sane_openssl_version(Version) ->
 	    true
     end.
 
+enough_openssl_crl_support("OpenSSL 0." ++ _) -> false;
+enough_openssl_crl_support(_) -> true.
+
 wait_for_openssl_server() ->
     receive
 	{Port, {data, Debug}} when is_port(Port) ->
-	    ct:log("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    %% openssl has started make sure
 	    %% it will be in accept. Parsing
 	    %% output is too error prone. (Even