NAME

       ssl_crl_cache_api - API for a SSL/TLS CRL (Certificate Revocation List) cache.

DESCRIPTION

       When  SSL/TLS  performs  certificate  path  validation  according to RFC 5280  it should also perform CRL
       validation checks. To enable the CRL checks the application needs access to CRLs. A database of CRLs  can
       be  set  up  in  many different ways. This module provides the behavior of the API needed to integrate an
       arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide
       a simple default implementation of a CRL cache.

DATA TYPES

       The following data types are used in the functions below:

         cache_ref() =:
           opaque()

         dist_point() =:
           #'DistributionPoint'{} see  X509 certificates records

EXPORTS

       fresh_crl(DistributionPoint, CRL) -> FreshCRL

              Types:

                  DistributionPoint = dist_point()
                  CRL = [public_key:der_encoded()]
                  FreshCRL = [public_key:der_encoded()]

              fun fresh_crl/2  will be used as input option update_crl to public_key:pkix_crls_validate/3

       lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs
       lookup(DistributionPoint, DbHandle) -> not_available | CRLs

              Types:

                  DistributionPoint = dist_point()
                  Issuer = public_key:issuer_name()
                  DbHandle = cache_ref()
                  CRLs = [public_key:der_encoded()]

              Lookup  the  CRLs belonging to the distribution point  Distributionpoint. This function may choose
              to only look in the cache or to follow distribution point links depending  on  how  the  cache  is
              administrated.

              The  Issuer  argument  contains  the  issuer  name  of the certificate to be checked. Normally the
              returned CRL should be issued by this issuer, except if the cRLIssuer field  of  DistributionPoint
              has a value, in which case that value should be used instead.

              In  an  earlier  version of this API, the lookup function received two arguments, omitting Issuer.
              For compatibility, this is still supported: if there is  no  lookup/3  function  in  the  callback
              module, lookup/2 is called instead.

       select(Issuer, DbHandle) -> CRLs

              Types:

                  Issuer = public_key:issuer_name()
                  DbHandle = cache_ref()

              Select the CRLs in the cache that are issued by Issuer