poka.sh

 Docs

CRL

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

X.509 CRL Preview.

At a glance
Purpose An X.509 certificate revocation list (DER or PEM): the serial numbers a certificate authority has revoked.
Extensions .crl
Poka parser poka-crl
Viewer poka-tree-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B2 Broad (see Breadth tiers)

How much Poka reads

B2 Broad. The common content of the current and the common older versions is decoded. Some named features or versions are not, and are listed.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-crl/src/main.rs (283 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has nextcloud_codesigning_root.crl, read by no test. Covers .crl. The tree decodes the CRL with x509-parser: issuer, this and next update, signature algorithm, CRL number, version and revoked count, and one node per revoked certificate with serial, revocation date and reason. Judgement: B2: the list is decoded in full; the gaps are extensions and verification.

What Poka does not read

  • The signature is not verified
  • CRL extensions other than the CRL number (authority key identifier, delta CRL, issuing distribution point) are not shown
  • Entry extensions other than the reason code are not shown
  • Only the first 2,000 revoked certificates are listed

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

  • x509-parser (used; MIT OR Apache-2.0; Rust)
  • cryptography (pyca) (candidate; Apache-2.0 OR BSD-3-Clause; Python; https://cryptography.io/en/latest/x509/reference/) — load_der_x509_crl and load_pem_x509_crl return CertificateRevocationList; repo carries Apache-2.0 and BSD-3-Clause licence files (github.com/pyca/cryptography), dual-licence wording inferred.
  • Go crypto/x509 (ParseRevocationList) (candidate; BSD-3-Clause; Go; https://pkg.go.dev/crypto/x509#ParseRevocationList) — Standard library; parses DER X.509 v2 CRLs.
  • rustls-webpki (candidate; ISC; Rust; https://docs.rs/rustls-webpki/latest/webpki/) — Exposes BorrowedCertRevocationList / OwnedCertRevocationList (RFC 5280 CRL) types; focused on revocation checking, v0.103.15 seen. Exact parse API not verified in detail.

Sources

  • parsers/poka-crl/src/main.rs
  • parsers/poka-crl/plugin.json