---
name: "libressl-X509_CRL_print"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_CRL_print"
---

# libressl-X509\_CRL\_print(3)

pretty-print a certificate revocation list

## NAME

**X509\_CRL\_print**, **X509\_CRL\_print\_fp** – pretty-print a certificate revocation list

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_CRL\_print**(*BIO \*bio*, *X509\_CRL \*crl*);

*int*\

**X509\_CRL\_print\_fp**(*FILE \*fp*, *X509\_CRL \*crl*);

## DESCRIPTION

**X509\_CRL\_print**() prints information contained in *crl* to *bio* in human-readable form, in the following order:

- The certificate revocation list version number as defined by the standard, followed in parentheses by the value contained in the version field in hexadecimal notation. See X509\_CRL\_get\_version(3) for details.

- The name of the signature algorithm is printed with X509\_signature\_print(3).

- The issuer name as returned by X509\_CRL\_get\_issuer(3).

- The times of the last and next updates as returned by X509\_CRL\_get0\_lastUpdate(3) and X509\_CRL\_get0\_nextUpdate(3) are printed with ASN1\_TIME\_print(3).

- All X.509 extensions directly contained in the certificate revocation list object *crl* are printed with X509V3\_extensions\_print(3).

- Information about revoked certificates is retrieved with X509\_CRL\_get\_REVOKED(3), and for each revoked certificate, the following is printed:

  - The serial number of the certificate is printed with i2a\_ASN1\_INTEGER(3).

  - The revocation date is printed with ASN1\_TIME\_print(3).

  - All X.509 extensions contained in the revocation entry are printed with X509V3\_extensions\_print(3).

- The signature of *crl* is printed with X509\_signature\_print(3).

**X509\_CRL\_print\_fp**() is similar to **X509\_CRL\_print**() except that it prints to *fp*.

## RETURN VALUES

These functions are intended to return 1 for success and 0 for error.

## SEE ALSO

BIO\_new(3), X509\_CRL\_new(3), X509\_print\_ex(3), X509\_REVOKED\_new(3)

## HISTORY

These functions first appeared in OpenSSL 0.9.2 and have been available since OpenBSD 2.6.

## BUGS

Most I/O errors are silently ignored. Even if the information printed is incomplete, these functions may return 1 anyway.

If the version number is invalid, no information from the CRL is printed and the functions fail.