Certificate revocation handling through CRL or OCSP

[jalas167]

OpenSSL can handle certificates revocation through calling hosted CRL file or OCSP service. We will most likely need to host CRL file or expose OCSP service and access one of them from ya-provider.

[pwalski]

Missing feature allowing to read CRL from file waits to be merged to rust openssl lib https://github.com/sfackler/rust-openssl/pull/1123 The problem is CRLs usually have short expiration date, so providers should be able to handle certificate property named crlDistributionPoints https://jamielinux.com/docs/openssl-certificate-authority/certificate-revocation-lists.html#prepare-the-configuration-file

[evik42]

Not relevant anymore. Closing in favor of #2156