我正在使用以下脚本在 OS X 10.11.6 El Capitan 上针对 crl 验证证书。
host=wikipedia.org
port=443
openssl s_client -connect $host:$port 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' > $host.pem
crlurl=$(openssl x509 -noout -text -in $host.pem | grep -A 4 'X509v3 CRL Distribution Points' | grep URI | grep -Eo '(http|https)://[^"]+')
curl $crlurl -o $host.crl.der
openssl crl -inform DER -in $host.crl.der -outform PEM -out $host.crl.pem
OLDIFS=$IFS; IFS=':' certificates=$(openssl s_client -connect "$host":"$port" -showcerts -tlsextdebug -tls1 2>&1 </dev/null | awk '/BEGIN CERT/ {p=1} ; p==1; /END CERT/ {p=0}' | sed 's/-----BEGIN/:-----BEGIN/g'); for certificate in ${certificates#:}; do echo $certificate | tee -a $host.chain.pem ; done; IFS=$OLDIFS
cat $host.chain.pem $host.crl.pem > $host.crl_chain.pem
openssl verify -crl_check -CAfile $host.crl_chain.pem $host.pem
它在 ubuntu 上运行良好，但在尝试在 OS X 10.11.6 El Capitan 上运行时抛出以下错误。
wikipedia.org.pem: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
error 2 at 1 depth lookup:unable to get issuer certificate
将 wikipedia.org 与 s_client 连接返回：
Verify return code: 20 (unable to get local issuer certificate)