Hi *, am I right in that there is currently no standard way for handling certificate revocation lists (CRL, RFC 2459) for X.509 certificates? It would be nice if CRLs in /etc/ssl/... could be updated automatically by a cron job that invokes openssl ocsp (RFC 2560) regularly and/or maintain official lists of revoked certificates in the package. Should this be part of ca-certificates or a separate package? Thanks, Hein -- http://hein.roehrig.name