iSECPartners/sslyze — pull request #27 by secworks (2013-06-20 10:29:51+00:00)
Title: CRL verification support

This patch adds optional CRL verification functionality.
If given --crl option when performing --certinfo, the plugin will look at the CRL uri in the cert, download the CRL, parse it and check if the cert ID is present in the CRL or not.

For performance reasons, the patch also implements a local, file based CRL cache. CRLs previously seen are not downloaded. Instead file with parsed and extracted revocation information is loaded. Finally, for CRL URIs that fail to load are also cached to remove repeated failed retrieval attempts when testing multiple domains.

Usage note:
Since CRL files are updated frequently, the generated files stored in the plugins/crl directory should be removed before a test session.