Preview Ruby 4.1 is a preview. It can change before the final release. Switch to Ruby 4.0 →
instance method
OpenSSL::X509::CRL#by_serial
crl.by_serial(serial) → OpenSSL::X509::Revoked or nil
ext/openssl/ossl_x509crl.c
View on GitHub ↗
static VALUE
ossl_x509crl_by_serial(VALUE self, VALUE serial)
{
X509_CRL *crl;
X509_REVOKED *rev = NULL;
ASN1_INTEGER *asn1_serial;
int found;
GetX509CRL(self, crl);
asn1_serial = num_to_asn1integer(serial, NULL);
/* 0 = not found, 1 = found, 2 = found with reason removeFromCRL */
found = X509_CRL_get0_by_serial(crl, &rev, asn1_serial);
ASN1_INTEGER_free(asn1_serial);
if (found == 0)
return Qnil;
/* ossl_x509revoked_new dups, so the result outlives the CRL safely */
return ossl_x509revoked_new(rev);
}
Looks up the certificate serial (an Integer or OpenSSL::BN) in the CRL and returns the matching OpenSSL::X509::Revoked entry, or nil if that serial is not listed.
Unlike iterating over revoked, this does not instantiate the entire revocation list: it performs a sorted lookup (wrapping the OpenSSL function X509_CRL_get0_by_serial), which is significantly faster and uses far less memory for large CRLs.
Example
crl.by_serial(cert.serial) #=> #<OpenSSL::X509::Revoked> or nil crl.by_serial(cert.serial)&.time #=> revocation time, if revoked