---
name: "ssl_crl_cache_api"
section: "3erl"
platform: "linux"
package: "erlang-manpages"
version: "1:25.2.3+dfsg-1+deb12u4"
release: "Debian 12 (Bookworm)"
platforms: ["linux"]
url: "https://new.carta.tech/ssl_crl_cache_api"
---

# ssl\_crl\_cache\_api(3erl)

API for a TLS CRL (Certificate Revocation List) cache.

## NAME

ssl\_crl\_cache\_api - API for a TLS CRL (Certificate Revocation List) cache.

## DESCRIPTION

When TLS performs certificate path validation according to RFC 5280  it should also perform CRL validation checks. To enable the CRL checks the application needs access to CRLs. A database of CRLs can be set up in many different ways. This module provides the behavior of the API needed to integrate an arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide a simple default implementation of a CRL cache.

## DATA TYPES

```
crl_cache_ref() = any()
```

Reference to the CRL cache.

```
dist_point() = #'DistributionPoint'{}
```

For description see  X509 certificates records

```
logger_info() =
    {logger:level(),
     Report :: #{description => string(), reason => term()},
     logger:metadata()}
```

Information for ssl applications use of  Logger(3erl)

## EXPORTS

**Module:fresh\_crl(DistributionPoint, CRL) -\> FreshCRL** \
 **Module:fresh\_crl(DistributionPoint, CRL) -\> FreshCRL \| {LoggerInfo, FreshCRL}**\

Types:

 DistributionPoint =  dist\_point() \
\
  CRL = \[public\_key:der\_encoded()\] \
\
  FreshCRL = \[public\_key:der\_encoded()\] \
\
  LoggerInfo = {logger,  logger\_info() }} \

*fun fresh\_crl/2*  will be used as input option *update\_crl* to public\_key:pkix\_crls\_validate/3

It is possible to return logger info that will be used by the TLS connection to produce log events.

**Module:lookup(DistributionPoint, Issuer, DbHandle) -\> not\_available \| CRLs \| {LoggerInfo, CRLs}** \
 **Module:lookup(DistributionPoint, Issuer, DbHandle) -\> not\_available \| CRLs** \
 **Module:lookup(DistributionPoint, DbHandle) -\> not\_available \| CRLs** \

Types:

 DistributionPoint =  dist\_point() \
\
  Issuer = public\_key:issuer\_name()\
\
  DbHandle =  crl\_cache\_ref() \
\
  CRLs = \[public\_key:der\_encoded()\]\
\
  LoggerInfo = {logger,  logger\_info() }} \

Lookup the CRLs belonging to the distribution point  *Distributionpoint*. This function may choose to only look in the cache or to follow distribution point links depending on how the cache is administrated.

The *Issuer* argument contains the issuer name of the certificate to be checked. Normally the returned CRL should be issued by this issuer, except if the *cRLIssuer* field of *DistributionPoint* has a value, in which case that value should be used instead.

In an earlier version of this API, the *lookup* function received two arguments, omitting *Issuer*. For compatibility, this is still supported: if there is no *lookup/3* function in the callback module, *lookup/2* is called instead.

It is possible to return logger info that will be used by the TLS connection to produce log events.

**Module:select(Issuer, DbHandle) -\> CRLs \| {LoggerInfo, CRLs}** \
 **Module:select(Issuer, DbHandle) -\> CRLs** \

Types:

 Issuer = public\_key:issuer\_name() \| list() \
\
  DbHandle =  cache\_ref() \
\
  LoggerInfo = {logger,  logger\_info() } \

Select the CRLs in the cache that are issued by *Issuer* unless the value is a list of so called general names, see  X509 certificates records, originating form *#'DistributionPoint'.cRLissuer* and representing different mechanism to obtain the CRLs. The cache callback needs to use the appropriate entry to retrieve the CRLs or return an empty list if it does not exist.

It is possible to return logger info that will be used by the TLS connection to produce log events.